#VU101951 Protection mechanism failure in Intel products - CVE-2024-36242

Vulnerability identifier: #VU101951

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-36242

CWE-ID: CWE-693

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
3rd Generation Intel Xeon Scalable Processors
Intel Xeon D Processors
4th Generation Intel Xeon Scalable Processors
4th Generation Intel Xeon Platinum processors
4th Generation Intel Xeon Gold Processors
4th Generation Intel Xeon Silver Processors
4th Generation Intel Xeon Bronze Processors
Intel Xeon CPU Max Series processors (High Bandwidth Memory HBM)
4th Generation Intel Xeon Scalable Processors with Intel vRAN
5th Generation Intel Xeon Scalable processors
4th Generation Intel Xeon Edge Enhanced Processors
Intel Xeon W2400 processor
Intel Xeon W3400 Processor

Software vendor:
Intel

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient implementation of security measures in the Sub-Page write Permissions (SPP). A local user can execute arbitrary code with elevated privileges.

Install updates from vendor's website.

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01196.html