Permissions, Privileges, and Access Controls in Intel products - CVE-2020-8731

Vulnerability identifier: #VU45706

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8731

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

Intel Server System LSVRP
Intel Server Board S2600BP
Intel Compute Module HNS2600BP
Intel Server Board S2600ST
Intel Server Board S2600WF
Intel Server System R2000WF
Intel Server System R1000WF
Intel Server Board S1200SP
Intel Server System LR1304SP
Intel Server System R1000WT
Intel Server System R1000SP
Intel Server Board S2600TP
Intel Compute Module HNS2600TP
Intel Server Board S2600KP
Intel Compute Module HNS2600KP
Intel Server Board S2600CW
Intel Server Boards S2600WT
Intel Server System R2000WT
Data Computing Appliance (DCA)
EMC ECS

Install updates from vendor's website.

Intel Server System LSVRP - update to 03.01.0049
Intel Server Board S2600BP - update to 02.01.0012
Intel Compute Module HNS2600BP - update to 02.01.0012
Intel Server Board S2600ST - update to 02.01.0011
Intel Server Board S2600WF - update to 02.01.0012
Intel Server System R2000WF - update to 02.01.0012
Intel Server System R1000WF - update to 02.01.0012
Intel Server Board S1200SP - update to 03.01.0049
Intel Server System LR1304SP - update to 03.01.0049
Intel Server System R1000WT - update to 01.01.0029
Intel Server System R1000SP - update to 03.01.0049
Intel Server Board S2600TP - update to 1.01.0029
Intel Compute Module HNS2600TP - update to 1.01.0029
Intel Server Board S2600KP - update to 1.01.0029
Intel Compute Module HNS2600KP - update to 1.01.0029
Intel Server Board S2600CW - update to 01.01.0029
Intel Server Boards S2600WT - update to 01.01.0029
Intel Server System R2000WT - update to 01.01.0029
Data Computing Appliance (DCA) - addressed in versions Firmware tool 3H00, 4.2.1.0
EMC ECS - addressed in versions 3.5.1.1, 3.6

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00384.html

• Multiple vulnerabilities in Intel Server Boards, Server Systems and Compute Modules
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in Dell EMC ECS