Buffer overflow in Intel products - CVE-2020-12358

Vulnerability identifier: #VU54165

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12358

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when in the firmware. A local administrator can trigger memory corruption and cause a denial of service condition on the target system.

Intel Xeon Processor E5 v3 Family
11th Generation Intel Core Processors
Intel Core Processors with Intel Hybrid Technology
Intel Core X-series Processors
6th Generation Intel Core Processors
7th Generation Intel Core Processors
8th Generation Intel Core Processors
10th Generation Intel Core Processors
Intel Xeon W Processors
2nd Generation Intel Xeon Scalable Processors
Intel Xeon Processor E5 v4 Family
Intel Xeon Processor E3 v5 Family
Intel Xeon Processor E3 v6 Family
Intel Xeon Processor E7 v4 Family
Intel Xeon Processor E Family
Intel Xeon D Processors
SIMATIC IPC527GE
SINUMERIK ONE PPU 1740
SINUMERIK ONE / SINUMERIK 840D sl Handheld Terminal HT 10
SINUMERIK MC MCU 1720
SINUMERIK 828D HW PPU.4
SIMATIC S7-1500 CPU 1518F-4 PN-DP MFP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
SIMATIC Drive Controller
SIMATIC IPC477E Pro
SIMATIC IPC127E
SIMATIC Field PG M6
SIMATIC Field PG M5
SIMATIC IPC627E
SIMATIC IPC647E
SIMATIC IPC677E
SIMATIC IPC847E
Intel Xeon Scalable Processors
SIMATIC ITP1000
SIMATIC IPC547G
SIMATIC IPC477E
SIMATIC IPC427E
SIMATIC ET 200SP Open Controller CPU 1515SP PC2
PowerFlex Appliance
Disk Library for mainframe (DLm)
Dell EMC VxRail Appliance

Install updates from vendor's website.

PowerFlex Appliance - addressed in versions Intelligent_Catalog_37_361_00_r14, Intelligent_Catalog_37_355_00_r16
Dell EMC VxRail Appliance - update to 4.5.462
Disk Library for mainframe (DLm) - update to 5.4.0.1
SIMATIC IPC627E - update to 25.02.10
SIMATIC IPC647E - update to 25.02.10
SIMATIC IPC677E - update to 25.02.10
SIMATIC IPC847E - update to 25.02.10

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html

• Multiple vulnerabilities in Intel Processors
• Multiple vulnerabilities in Siemens Industrial Products Intel CPUs
• Multiple vulnerabilities in Dell EMC Disk Library for mainframe
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Dell PowerFlex Appliance