Intel Server Boards/Server Systems/Compute Modules up to 2.46 heap-based overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in Intel Server Boards, Server Systems and Compute Modules up to 2.46. Affected by this vulnerability is an unknown functionality. Such manipulation leads to heap-based overflow. This vulnerability is referenced as CVE-2020-12375. The attack can only be performed from a local environment. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Intel Server Boards, Server Systems and Compute Modules up to 2.46 (Forum Software) and classified as critical. Affected by this issue is some unknown functionality. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability.

The weakness was published 02/17/2021 as intel-sa-00434. The advisory is shared for download at intel.com. This vulnerability is handled as CVE-2020-12375. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.47 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Forum Software

Vendor

• Intel

Name

• Compute Modules
• Server Boards
• Server Systems

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40
• 2.41
• 2.42
• 2.43
• 2.44
• 2.45
• 2.46

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion