CVE-2023-29494

Vulnerability

Improper input validation in the BIOS firmware of select Intel NUC (Next Unit of Computing) models allows a privileged user to trigger an escalation of privilege. The vulnerability resides in the firmware's handling of input data during system initialization. Affected versions are detailed in Intel advisory INTEL-SA-00892 [1].

Exploitation

An attacker must have local access to the system and possess elevated privileges (e.g., administrator or root) to exploit this vulnerability. The attacker can craft malicious input that bypasses validation checks in the BIOS firmware, leading to execution of arbitrary code at a higher privilege level.

Impact

Successful exploitation enables the attacker to escalate privileges within the firmware environment, potentially gaining full control over the system's low-level operations, including the ability to modify firmware settings or execute code with system management mode (SMM) privileges.

Mitigation

Intel has released firmware updates to address this vulnerability. Users should update their BIOS to the latest version provided by Intel for their specific NUC model. The advisory INTEL-SA-00892 [1] provides the list of affected products and the fixed firmware versions.