Improper access control in Intel products - CVE-2024-36293

Vulnerability identifier: #VU104108

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-36293

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: Intel

Affected software:
Software Guard Extensions (SGX)
3rd Generation Intel Xeon Scalable Processors
11th Generation Intel Core Processors
Intel Xeon E-2300 processor family
Intel Xeon D Processors
8th Generation Intel Core Processors
Intel Xeon E Processors
4th Generation Intel Xeon Scalable Processors
4th Generation Intel Xeon Platinum processors
4th Generation Intel Xeon Gold Processors
4th Generation Intel Xeon Silver Processors
4th Generation Intel Xeon Bronze Processors
Intel Xeon CPU Max Series processors
9th Generation Intel Core Processors

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the EDECCSSA user leaf function. A local user can bypass implemented security restrictions and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01213.html
• https://www.dell.com/support/kbdoc/en-us/000283897/dsa-2025-041-security-update-for-dell-poweredge-server-for-intel-2025-security-advisories-2025-1-ipu