CVE-2021-33074

Vulnerability

A protection mechanism failure in the firmware of certain Intel® SSDs (including Intel® SSD, Intel® SSD DC, and Intel® Optane™ SSD products) allows an unauthenticated user to potentially enable information disclosure via physical access [1]. The affected products and firmware versions are detailed in the Intel advisory INTEL-SA-00563.

Exploitation

The attacker must have physical access to the target SSD. By attaching the SSD to a system capable of issuing commands that bypass the intended firmware protection checks, the attacker can directly read data that the firmware should have protected [1]. No authentication or prior user interaction is required beyond obtaining physical possession of the drive.

Impact

Successful exploitation results in unauthorized information disclosure. An unauthenticated attacker with physical access can read sensitive data stored on the drive that the firmware was designed to protect [1]. The confidentiality of disk contents is compromised; integrity and availability are not directly affected.

Mitigation

Intel has released firmware updates to address this vulnerability. Affected users should update to the fixed firmware versions listed in the Intel advisory INTEL-SA-00563 [1]. No workaround is available; the only mitigation is applying the firmware update. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

[1]: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00563.html