Intel FPGA Products prior 2.9.0 out-of-bounds write

Summaryinfo

A vulnerability identified as critical has been detected in Intel FPGA Products. This affects an unknown function. This manipulation causes out-of-bounds write. The identification of this vulnerability is CVE-2023-49614. The attack can only be executed locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Intel FPGA Products. It has been declared as problematic. Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Out of bounds write in firmware for some Intel(R) FPGA products before version 2.9.0 may allow escalation of privilege and information disclosure.

It is possible to read the advisory at intel.com. This vulnerability is known as CVE-2023-49614 since 11/28/2023. The exploitation appears to be difficult. Attacking locally is a requirement. Additional levels of successful authentication are needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 2.9.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Intel

Name

• FPGA Products

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion