CVE-2020-8675

Insufficient control flow management in firmware build and signing tool for Intel(R) Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

CVSS v3 6.8 MEDIUM
CVSS v2.0 4.6 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00366.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:intel:innovation_engine_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:intel:innovation_engine:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-06-15 14:15

Updated : 2024-02-04 21:00

NVD link : CVE-2020-8675

Mitre link : CVE-2020-8675

CVE.ORG link : CVE-2020-8675

JSON object : View

Products Affected

intel

innovation_engine
innovation_engine_firmware

CWE

NVD-CWE-noinfo

{"id": "CVE-2020-8675", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2020-06-15T14:15:12.517", "references": [{"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00366.html", "tags": ["Vendor Advisory"], "source": "secure@intel.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Insufficient control flow management in firmware build and signing tool for Intel(R) Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access."}, {"lang": "es", "value": "Una administraci\u00f3n del flujo de control insuficiente en la herramienta de compilaci\u00f3n y firma del firmware para Intel\u00ae Innovation Engine versiones anteriores a 1.0.859, puede permitir a un usuario no autenticado habilitar potencialmente una escalada de privilegios por medio de un acceso f\u00edsico"}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:intel:innovation_engine_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "218FC82B-6D79-4821-90CD-AD48F50ECF70", "versionEndExcluding": "1.0.859"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:intel:innovation_engine:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F63AEBCF-DD25-4DAB-AFAB-8CC931AE0AC5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "secure@intel.com"}