Heap-based buffer overflow in Intel products - CVE-2023-31276

Vulnerability identifier: #VU107015

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-31276

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error. A local privileged user can trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.

Intel Server Board M50CYP
Intel Server Board D50TNP
Intel Server Board S2600WF
Intel Server Board S2600ST
Intel Server Board S2600BP

Install updates from vendor's website.

Intel Server Board M50CYP - update to R01.01.0009
Intel Server Board D50TNP - update to R01.01.0009
Intel Server Board S2600WF - update to 02.01.0017
Intel Server Board S2600ST - update to 02.01.0017
Intel Server Board S2600BP - update to 02.01.0017

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00990.html

• Multiple vulnerabilities in Intel Server Board BMC firmware