Medium severity · published Jun 9, 2021
CVE-2020-12294
Insufficient control flow management in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Insufficient control flow management in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DT
Dsl5320 Thunderbolt 2 Firmware · Intel
All versions, or not specified · source: NVD
DT
Dsl5520 Thunderbolt 2 Firmware · Intel
All versions, or not specified · source: NVD
DT
Dsl6340 Thunderbolt 3 Firmware · Intel
All versions, or not specified · source: NVD
DT
Dsl6540 Thunderbolt 3 Firmware · Intel
All versions, or not specified · source: NVD
JT
Jhl6240 Thunderbolt 3 Firmware · Intel
before 21 · source: NVD
JT
Jhl6340 Thunderbolt 3 Firmware · Intel
before 46 · source: NVD
JT
Jhl6540 Thunderbolt 3 Firmware · Intel
before 46 · source: NVD
JT
Jhl7040 Thunderbolt 3 Retimer Firmware · Intel
before 22 · source: NVD
JT
Jhl7340 Thunderbolt 3 Firmware · Intel
before 60 · source: NVD
JT
Jhl7440 Thunderbolt 3 Firmware · Intel
before 60 · source: NVD
JT
Jhl7540 Thunderbolt 3 Firmware · Intel
before 60 · source: NVD
JU
Jhl8010r Usb Retimer Firmware · Intel
before 41 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-12294
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-12294
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html
More from Dsl5320 Thunderbolt 2 Firmware
5.5
CVE-2020-12296
Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access
5.5
CVE-2020-12295
Improper input validation in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access
5.5
CVE-2020-12293
Improper control of a resource through its lifetime in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local…
5.5
CVE-2020-12292
Improper conditions check in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access
5.5
CVE-2020-12291
Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access