Vulnerability identifier: #VU63179
Vulnerability risk: Low
CVSSv3.1:
CVE-ID:
CWE-ID:
CWE-20
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
2nd Generation Intel Xeon Scalable Processors
Hardware solutions /
Firmware
3rd Generation Intel Xeon Scalable Processors
Hardware solutions /
Firmware
Vendor: Intel
Description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input in the BIOS authenticated code module. A local user can pass specially crafted data to the affected module and execute arbitrary code on the system with elevated privileges.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
2nd Generation Intel Xeon Scalable Processors: All versions
3rd Generation Intel Xeon Scalable Processors: All versions
CPE
External links
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00601.html
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?