Out-of-bounds read in Intel products - CVE-2021-33120

Vulnerability identifier: #VU60492

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33120

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to a boundary condition in memory subsystem. A local user can trigger out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.

Intel Atom Processor E3900 Series
Intel Pentium Processor J Series
Intel Pentium Processor N Series
Intel Xeon Scalable Processors
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
Intel Xeon Processors
Intel Celeron Processors
Intel Core Processors with Intel Hybrid Technology
Intel Celeron Processor J Series
Intel Celeron Processor N Series
Intel Pentium Processor Silver Series
Intel Puma 7 Family
3rd Generation Intel Xeon Scalable Processors
6th Generation Intel Core Processors
4th Generation Intel Core Processor Family
Intel Atom Processor A Series
Intel Xeon D Processors
2nd Generation Intel Xeon Scalable Processors
Intel Core X-series Processor
Intel Atom Processor X Series
Intel Pentium Gold Processor Series
11th Generation Intel Core Processors
Intel Xeon E-2300 processor family
10th Generation Intel Core Processors
Intel Xeon W Processors
Intel Xeon E Processors
8th Generation Intel Core Processors
Intel Xeon W-1300 Processor Family
Intel Celeron Processor G Series
7th Generation Intel Core Processors
Intel Pentium Processors
Intel Core X-series Processors
Intel Atom Processors
12th Generation Intel Core Processors
Intel Celeron Processor 5000 Series
2th Generation Intel Core Processor Family
3th Generation Intel Core Processor Family
9th Generation Intel Core Processors
IBM Qradar SIEM
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
Ubuntu
intel-microcode (Ubuntu package)
ucode-intel
ucode-intel-debuginfo
ucode-intel-debugsource

Install updates from vendor's website.

intel-microcode (Ubuntu package) - addressed in versions 3.20220510.0ubuntu0.16.04.1+esm1, 3.20220510.0ubuntu0.18.04.1, 3.20220510.0ubuntu0.20.04.1, 3.20220510.0ubuntu0.21.10.1, 3.20220510.0ubuntu0.22.04.1
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
ucode-intel - addressed in versions 20220207-3.38.1, 20220207-3.70.1, 20220207-3.206.1, 20220207-10.1, 20220207-13.93.1
ucode-intel-debuginfo - addressed in versions 20220207-3.38.1, 20220207-13.93.1
ucode-intel-debugsource - addressed in versions 20220207-3.38.1, 20220207-13.93.1

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00589.html

• Out-of-bounds read in Intel Atom Processors
• Ubuntu update for intel-microcode
• Ubuntu update for intel-microcode
• Multiple vulnerabilities in IBM QRadar SIEM
• SUSE update for ucode-intel
• SUSE update for ucode-intel
• SUSE update for ucode-intel
• SUSE update for ucode-intel
• SUSE update for ucode-intel
• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT