ID

VAR-202011-0621

CVE

CVE-2020-24525

TITLE

plural  Intel(R) NUC  Illegal permission retention vulnerability in firmware

DESCRIPTION

Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access. plural Intel(R) NUC There is a vulnerability in the firmware regarding improper retention of permissions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Document Title: =============== Intel NUC - Local Privilege Escalation Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2267 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24525 CVE-ID: ======= CVE-2020-24525 Release Date: ============= 2020-11-13 Vulnerability Laboratory ID (VL-ID): ==================================== 2267 Common Vulnerability Scoring System: ==================================== 6.7 Vulnerability Class: ==================== Privilege Escalation Current Estimated Price: ======================== 10.000€ - 25.000€ Product & Service Introduction: =============================== The Intel® NUC kit consists of a customizable mainboard and housing. You can choose from a large selection of memory and data storage as well as the operating system. (Copy of the Homepage: https://www.intel.de/content/www/de/de/products/boards-kits/nuc/kits.html ) Abstract Advisory Information: ============================== A vulnerability laboratory core team researcher discovered a local privilege escalation in the official Intel® NUC. Affected Product(s): ==================== Intel® NUC Intel® NUC Board DE3815TYBE with a SA number H27002-500 and later. The SA number is located on the back of the chassis. TYBYT20H.86A Intel® NUC Kit DE3815TYKHE with an AA number H26998-500 and later. The AA number is found on the board’s memory module socket. TYBYT20H.86A Intel® NUC Board DE3815TYBE with the following SA numbers: H27002-400, -401, -402, -404, and -404. The SA number is located on the back of the chassis. TYBYT10H.86A Intel® NUC Kit DE3815TYKHE with the following AA numbers: H26998-401, -402, -403, -404, and -405. The AA number is found on the board’s memory module socket. TYBYT10H.86A Intel® NUC 8 Rugged Kit NUC8CCHKR CHAPLCEL.0049 Intel® NUC Board NUC8CCHB CHAPLCEL.0049 Intel® NUC 8 Pro Mini PC NUC8i3PNK PNWHL357.0037 Intel® NUC 8 Pro Kit NUC8i3PNK PNWHL357.0037 Intel® NUC 8 Pro Kit NUC8i3PNH PNWHL357.0037 Intel® NUC 8 Pro Board NUC8i3PNB PNWHL357.0037 Intel® NUC 9 Pro Kit - NUC9V7QNX QNCFLX70.34 Intel® NUC 9 Pro Kit - NUC9VXQNX QNCFLX70.34 Intel® NUC 8 Mainstream-G kit (NUC8i5INH) INWHL357.0036 Intel® NUC 8 Mainstream-G kit (NUC8i7INH) INWHL357.0036 Intel® NUC 8 Mainstream-G mini PC (NUC8i5INH) INWHL357.0036 Intel® NUC 8 Mainstream-G mini PC (NUC8i7INH) INWHL357.0036 Vulnerability Disclosure Timeline: ================================== 2020-11-13: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Exploitation Technique: ======================= Local Severity Level: =============== Medium Authentication Type: ==================== Restricted Authentication (User Privileges) User Interaction: ================= No User Interaction Disclosure Type: ================ Bug Bounty Technical Details & Description: ================================ Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user with system privileges to potentially enable an escalation of the local process privilege via local system access. Solution - Fix & Patch: ======================= Intel recommends that users update to the latest NUC firmware version (see provided table). Intel recommends users update HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN to an updated version 1.76 via the following URL: https://downloadcenter.intel.com/download/27315?v=t Security Risk: ============== The security risk of the local privilege escalation vulnerability in the intel nuc is estimated as medium. Credits & Authors: ================== S.AbenMassaoud [Core Research Team] - https://www.vulnerability-lab.com/show.php?user=S.AbenMassaoud Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. Domains: www.vulnerability-lab.com www.vuln-lab.com www.vulnerability-db.com Services: magazine.vulnerability-lab.com paste.vulnerability-db.com infosec.vulnerability-db.com Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php vulnerability-lab.com/rss/rss_upcoming.php vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php vulnerability-lab.com/register.php vulnerability-lab.com/list-of-bug-bounty-programs.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@ or research@) to get a ask permission. Copyright © 2020 | Vulnerability Laboratory - [Evolution Security GmbH]™ -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

other

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

S.AbenMassaoud

SOURCES

LAST UPDATE DATE

2024-11-23T21:35:08.946000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE