Improper input validation in Intel products - CVE-2020-12377

Vulnerability identifier: #VU50586

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12377

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a improper input validation in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47. A local privileged user can  execute arbitrary code on the target system with elevated privileges.

Intel Server Board S2600WF
Intel Server System R1000WF
Intel Server System R2000WF
Intel Server Board S2600ST
Intel Compute Module HNS2600BP
Intel Server Board S2600BP

Install updates from vendor's website.

Intel Server Board S2600WF - update to 02.01.0013
Intel Server System R1000WF - update to 02.01.0013
Intel Server System R2000WF - update to 02.01.0013
Intel Server Board S2600ST - update to 02.01.0013
Intel Compute Module HNS2600BP - update to 02.01.0013
Intel Server Board S2600BP - update to 02.01.0013

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00434.html

• Multiple vulnerabilities in Intel Server Boards, Server Systems and Compute Modules