Heap-based buffer overflow in Intel products - CVE-2020-12375

Vulnerability identifier: #VU50591

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12375

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47. A local user can a heap-based buffer overflow and execute arbitrary code on the target system with elevated privileges.

Intel Server Board S2600WF
Intel Server System R1000WF
Intel Server System R2000WF
Intel Server Board S2600ST
Intel Compute Module HNS2600BP
Intel Server Board S2600BP

Install updates from vendor's website.

Intel Server Board S2600WF - update to 02.01.0013
Intel Server System R1000WF - update to 02.01.0013
Intel Server System R2000WF - update to 02.01.0013
Intel Server Board S2600ST - update to 02.01.0013
Intel Compute Module HNS2600BP - update to 02.01.0013
Intel Server Board S2600BP - update to 02.01.0013

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00434.html

• Multiple vulnerabilities in Intel Server Boards, Server Systems and Compute Modules