High severity · published Nov 12, 2020
CVE-2020-8739
Use of potentially dangerous function in Intel BIOS platform sample code for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Use of potentially dangerous function in Intel BIOS platform sample code for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Aff Bios · Netapp
All versions, or not specified · source: NVD
BI
Bios · Intel
All versions, or not specified · source: NVD
FB
Fas Bios · Netapp
All versions, or not specified · source: NVD
HC
Hci Compute Node Bios · Netapp
All versions, or not specified · source: NVD
HS
Hci Storage Node Bios · Netapp
All versions, or not specified · source: NVD
SB
Solidfire Bios · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8739
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8739
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210122-0008/
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00390
More from Bios
8.0
CVE-2019-14557
Buffer overflow in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow an authenticated user to…
7.8
CVE-2020-12360
Out of bounds read in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access
7.8
CVE-2020-8672
Out of bound read in BIOS firmware for 8th, 9th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 Series Processors may allow an unauthenticated user to potentially…
7.8
CVE-2018-3612
Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate privileges to System Management Mode (SMM)
6.8
CVE-2020-12359
Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical…