CVE-2022-36349

Vulnerability

Insecure default variable initialization in the BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 allows an authenticated user to enable denial of service via local access [1]. The vulnerability is present in the default configuration and does not require additional privileges beyond standard user authentication.

Exploitation

An attacker must have local access to the system and valid user authentication. The exploitation involves leveraging the insecure default variable initialization to cause a denial of service condition. No special prior privileges are needed beyond authentication.

Impact

Successful exploitation allows the attacker to cause denial of service, rendering the system unavailable. The impact is limited to availability; confidentiality and integrity are not affected per the advisory.

Mitigation

Intel has released BIOS version MYi30060 to address this issue. Users should update to this version or later [1]. No workarounds are provided in the advisory.