Medium severity · published Nov 12, 2020
CVE-2020-8694
Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access
5.5
CVSS
0.5%
EPSS
No
On KEV
Description
Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C3
Celeron 3865u Firmware · Intel
All versions, or not specified · source: NVD
C3
Celeron 3965u Firmware · Intel
All versions, or not specified · source: NVD
C3
Celeron 3965y Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-7007u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-7100u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-7110u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-7130u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-7367u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I5-7200u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I5-7210u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I5-7260u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I5-7267u Firmware · Intel
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8694
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8694
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf
lists.debian.org
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389
More from Celeron 3865u Firmware
8.0
CVE-2023-25756
Out-of-bounds read in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via adjacent access
6.4
CVE-2022-21198
Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local…
5.5
CVE-2020-8695
Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access
3.5
CVE-2023-22329
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via adjacent access