CVE-2021-33078

Vulnerability

A race condition vulnerability exists in the firmware of certain Intel(R) Optane(TM) SSD and Intel(R) SSD DC products. Specifically, a race condition within a thread can be triggered by a privileged user with local access, leading to denial of service. Affected products and firmware versions are listed in the Intel advisory INTEL-SA-00563 [1].

Exploitation

An attacker must be a privileged user with local access to the system. By initiating concurrent operations that trigger a race condition within the firmware thread, the attacker can cause the solid-state drive to enter an unstable state, resulting in denial of service [1]. No user interaction beyond local system access is required.

Impact

Successful exploitation leads to denial of service for the affected Intel SSD, making the drive unavailable for read/write operations. The confidentiality and integrity of data are not directly compromised, but the availability of storage is impacted [1].

Mitigation

Intel has released firmware updates to address this vulnerability. Users should update their drive firmware to the version specified in INTEL-SA-00563 [1]. There are no known workarounds; updating firmware is the recommended mitigation.