Intel Server Board/Server System/Compute Module up to 1.58 out-of-bounds write

Summaryinfo

A vulnerability classified as critical has been found in Intel Server Board, Server System and Compute Module up to 1.58. This issue affects some unknown processing. This manipulation causes out-of-bounds write. This vulnerability appears as CVE-2020-8732. The attacker needs to be present on the local network. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Intel Server Board, Server System and Compute Module up to 1.58 (Forum Software). Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Heap-based buffer overflow in the firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

The weakness was presented 08/13/2020 (Website). It is possible to read the advisory at intel.com. This vulnerability is known as CVE-2020-8732 since 02/06/2020. Access to the local network is required for this attack to succeed. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.59 eliminates this vulnerability.

See VDB-159802, VDB-159803, VDB-159804 and VDB-159805 for similar entries. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Forum Software

Vendor

• Intel

Name

• Compute Module
• Server Board
• Server System

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47
• 1.48
• 1.49
• 1.50
• 1.51
• 1.52
• 1.53
• 1.54
• 1.55
• 1.56
• 1.57
• 1.58

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion