Multiple vulnerabilities in Intel BIOS firmware
| Risk | Medium |
| Patch available | NO |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2020-8672 CVE-2019-14557 CVE-2019-14558 CVE-2020-8671 CVE-2019-14556 |
| CWE-ID | CWE-125 CWE-119 CWE-264 CWE-399 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software |
8th Generation Intel Core Processors Hardware solutions / Firmware 10th Generation Intel Core Processors Hardware solutions / Firmware Intel® Celeron® Processor 5000 Series Hardware solutions / Firmware Intel Celeron Processor 4000 Series Hardware solutions / Firmware 9th Generation Intel Core Processors Client/Desktop applications / Web browsers |
| Vendor | Intel |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Out-of-bounds read
EUVDB-ID: #VU46550
Risk: Low
CVSSv3.1: 3.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:U/RL:U/RC:C]
CVE-ID: CVE-2020-8672
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in in BIOS firmware for 8th, 9th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 Series Processors. A local user can trigger out-of-bounds read error and read contents of memory on the system.
MitigationIntel recommends that users of above Intel® products update to the latest BIOS version provided by the system manufacturer that addresses these issues.
Vulnerable software versions8th Generation Intel Core Processors: 15.33.49.5100 - 3349
9th Generation Intel Core Processors: 15.33.49.5100 - 26.20.100.7755
10th Generation Intel Core Processors: 15.33.49.5100 - 26.20.100.7755
Intel® Celeron® Processor 5000 Series: All versions
Intel Celeron Processor 4000 Series: All versions
CPE2.3- cpe:2.3:h:intel:8th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:8th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:h:intel:8th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:h:intel:intel®_celeron®_processor_5000_series:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:intel_celeron_processor_4000_series:*:*:*:*:*:*:*:
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00356.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Buffer overflow
EUVDB-ID: #VU46551
Risk: Medium
CVSSv3.1: 7.3 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2019-14557
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors. A remote authenticated user on the local network can send specially crafted traffic to the system, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationIntel recommends that users of above Intel® products update to the latest BIOS version provided by the system manufacturer that addresses these issues.
Vulnerable software versions8th Generation Intel Core Processors: 15.33.49.5100 - 3349
9th Generation Intel Core Processors: 15.33.49.5100 - 26.20.100.7755
10th Generation Intel Core Processors: 15.33.49.5100 - 26.20.100.7755
Intel® Celeron® Processor 5000 Series: All versions
Intel Celeron Processor 4000 Series: All versions
CPE2.3- cpe:2.3:h:intel:8th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:8th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:h:intel:8th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:h:intel:intel®_celeron®_processor_5000_series:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:intel_celeron_processor_4000_series:*:*:*:*:*:*:*:
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00356.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU46552
Risk: Medium
CVSSv3.1: 7.3 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2019-14558
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the system.
The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors. A remote user on the local network can send specially crafted data to the system and execute arbitrary code.
Intel recommends that users of above Intel® products update to the latest BIOS version provided by the system manufacturer that addresses these issues.
Vulnerable software versions8th Generation Intel Core Processors: 15.33.49.5100 - 3349
9th Generation Intel Core Processors: 15.33.49.5100 - 26.20.100.7755
10th Generation Intel Core Processors: 15.33.49.5100 - 26.20.100.7755
Intel® Celeron® Processor 5000 Series: All versions
Intel Celeron Processor 4000 Series: All versions
CPE2.3- cpe:2.3:h:intel:8th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:8th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:h:intel:8th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:h:intel:intel®_celeron®_processor_5000_series:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:intel_celeron_processor_4000_series:*:*:*:*:*:*:*:
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00356.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU46553
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:C]
CVE-ID: CVE-2020-8671
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass in BIOS firmware 8th, 9th Generation Intel(R) Core(TM) Processors and Intel(R) Celeron(R) Processor 4000 Series. A remote user on the local network can send specially crafted data to the system and gain access to sensitive information.
Intel recommends that users of above Intel® products update to the latest BIOS version provided by the system manufacturer that addresses these issues.
Vulnerable software versions8th Generation Intel Core Processors: 15.33.49.5100 - 3349
9th Generation Intel Core Processors: 15.33.49.5100 - 26.20.100.7755
10th Generation Intel Core Processors: 15.33.49.5100 - 26.20.100.7755
Intel® Celeron® Processor 5000 Series: All versions
Intel Celeron Processor 4000 Series: All versions
CPE2.3- cpe:2.3:h:intel:8th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:8th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:h:intel:8th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:h:intel:intel®_celeron®_processor_5000_series:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:intel_celeron_processor_4000_series:*:*:*:*:*:*:*:
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00356.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Resource management error
EUVDB-ID: #VU46554
Risk: Low
CVSSv3.1: 4.1 [CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2019-14556
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors. A remote user on the local network can pass specially crafted data to the system and perform a denial of service (DoS) attack.
MitigationIntel recommends that users of above Intel® products update to the latest BIOS version provided by the system manufacturer that addresses these issues.
Vulnerable software versions8th Generation Intel Core Processors: 15.33.49.5100 - 3349
9th Generation Intel Core Processors: 15.33.49.5100 - 26.20.100.7755
10th Generation Intel Core Processors: 15.33.49.5100 - 26.20.100.7755
Intel® Celeron® Processor 5000 Series: All versions
Intel Celeron Processor 4000 Series: All versions
CPE2.3- cpe:2.3:h:intel:8th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:8th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:h:intel:8th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:a:intel:9th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:15.33.49.5100:*:*:*:*:*:*:
- cpe:2.3:h:intel:10th_generation_intel_core_processors:15.33.50.5129:*:*:*:*:*:*:
- cpe:2.3:h:intel:intel®_celeron®_processor_5000_series:*:*:*:*:*:*:*:
- cpe:2.3:h:intel:intel_celeron_processor_4000_series:*:*:*:*:*:*:*:
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00356.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
