CVE-2020-8718

Vulnerability

A buffer overflow vulnerability exists in a subsystem of certain Intel(R) Server Boards, Server Systems, and Compute Modules with firmware versions prior to 1.59. The issue is triggered during local access by an authenticated user. The affected products include multiple models of Intel server platforms.

Exploitation

An attacker must have authenticated local access to the system. The exploitation involves sending crafted input that triggers a buffer overflow in the vulnerable subsystem, which can then be leveraged for privilege escalation. No network-based exploitation is described; the attack vector is local.

Impact

Successful exploitation allows an authenticated user to escalate their privileges on the affected system. The CVSS v3.1 base score is 6.7 (Medium), with the vector string AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating high impacts to confidentiality, integrity, and availability, but requiring high privileges and local access.

Mitigation

The vulnerability is fixed in firmware version 1.59, released by Intel. Users should update the firmware on affected server boards, systems, and compute modules to version 1.59 or later. No workarounds are provided in the advisory [1].