CVE-2023-22661

Published: May 10, 2023Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Buffer overflow in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access.

Affected (10)

Products: Intel: Server System D50tnp1mhcrlc Firmware, Server System D50tnp1mhcpac Firmware, Server System D50tnp2mhsvac Firmware, Server System D50tnp2mhstac Firmware, Server System D50tnp1mhcrac Firmware, Server System D50tnp2mfalac Firmware, Server System M50cyp1ur204 Firmware, Server System M50cyp1ur212 Firmware, Server System M50cyp2ur312 Firmware, Server System M50cyp2ur208 Firmware

Intel

10 products

Server System D50tnp1mhcrlc Firmware

Server System D50tnp1mhcpac Firmware

Server System D50tnp2mhsvac Firmware

Server System D50tnp2mhstac Firmware

Server System D50tnp1mhcrac Firmware

Server System D50tnp2mfalac Firmware

Server System M50cyp1ur204 Firmware

Server System M50cyp1ur212 Firmware

Server System M50cyp2ur312 Firmware

Server System M50cyp2ur208 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intel Server System D50tnp1mhcrlc Firmware	Before 2.90

Running on/with	Platform Versions
Intel Server System D50tnp1mhcrlc	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intel Server System D50tnp1mhcpac Firmware	Before 2.90

Running on/with	Platform Versions
Intel Server System D50tnp1mhcpac	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intel Server System D50tnp2mhsvac Firmware	Before 2.90

Running on/with	Platform Versions
Intel Server System D50tnp2mhsvac	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intel Server System D50tnp2mhstac Firmware	Before 2.90

Running on/with	Platform Versions
Intel Server System D50tnp2mhstac	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intel Server System D50tnp1mhcrac Firmware	Before 2.90

Running on/with	Platform Versions
Intel Server System D50tnp1mhcrac	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intel Server System D50tnp2mfalac Firmware	Before 2.90

Running on/with	Platform Versions
Intel Server System D50tnp2mfalac	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intel Server System M50cyp1ur204 Firmware	Before 2.90

Running on/with	Platform Versions
Intel Server System M50cyp1ur204	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intel Server System M50cyp1ur212 Firmware	Before 2.90

Running on/with	Platform Versions
Intel Server System M50cyp1ur212	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intel Server System M50cyp2ur312 Firmware	Before 2.90

Running on/with	Platform Versions
Intel Server System M50cyp2ur312	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intel Server System M50cyp2ur208 Firmware	Before 2.90

Running on/with	Platform Versions
Intel Server System M50cyp2ur208	All versions

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (2)

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html

Source: secure@intel.com

PatchVendor Advisory

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.