Improper Initialization in Intel products - CVE-2020-8705

Vulnerability identifier: #VU48681

CSH Severity: Low

CVSS v4: 5.4 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8705

CWE-ID: CWE-665

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to improper initialization in Intel Boot Guard. An attacker with physical access can run a specially crafted application to execute arbitrary code with escalated privileges on the system.

Converged Security and Management Engine (CSME)
Intel Trusted Execution Engine Firmware
Intel Server Platform Services Firmware

Install updates from vendor's website.

Converged Security and Management Engine (CSME) - addressed in versions 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45, 14.5.25
Intel Trusted Execution Engine Firmware - addressed in versions 3.1.80, 4.0.30
Intel Server Platform Services Firmware - addressed in versions SoC-A_04.00.04.300, SoC-X_04.00.04.200, E3_04.01.04.200, E3_05.01.04.200, E5_04.01.04.400

• https://security.netapp.com/advisory/ntap-20201113-0002/
• https://security.netapp.com/advisory/ntap-20201113-0004/
• https://security.netapp.com/advisory/ntap-20201113-0005/
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391

• Privilege escalation in Intel CSME, TXE and SPS