Improper access control in Intel products - CVE-2023-29164

Vulnerability identifier: #VU107016

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-29164

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in in BMC Firmware. A local user can escalate privileges on the system.

Intel Server Board M50CYP
Intel Server Board D50TNP
Intel Server Board S2600WF
Intel Server Board S2600ST
Intel Server Board S2600BP

Install updates from vendor's website.

Intel Server Board M50CYP - update to R01.01.0009
Intel Server Board D50TNP - update to R01.01.0009
Intel Server Board S2600WF - update to 02.01.0017
Intel Server Board S2600ST - update to 02.01.0017
Intel Server Board S2600BP - update to 02.01.0017

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00990.html

• Multiple vulnerabilities in Intel Server Board BMC firmware