CVE-2021-33080

Vulnerability

The vulnerability exists in firmware for Intel(R) SSD DC, Intel(R) Optane(TM) SSD, and Intel(R) Optane(TM) SSD DC products. Debug information is not cleared from the firmware, leading to exposure of sensitive system information. Affected versions include firmware versions prior to the updates specified in Intel advisory INTEL-SA-00563 [1].

Exploitation

An unauthenticated attacker must have physical access to the device. The attacker can potentially read the uncleared debug information from the firmware, which exposes sensitive system data. No authentication or special privileges are required beyond physical possession of the device [1].

Impact

A successful exploit could allow an attacker to obtain sensitive system information, leading to information disclosure. This may further enable escalation of privilege on the affected system. The impact is limited to physical attacks [1].

Mitigation

Intel has released firmware updates to address this vulnerability. Users should update their SSD firmware to the latest version provided by the device manufacturer or Intel. The fixed versions and release dates are detailed in INTEL-SA-00563 [1]. No workarounds are mentioned; physical security is recommended as a preventive measure.