High severity · published Feb 9, 2022
CVE-2021-0091
Improper access control in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable an escalation of privilege via local access
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Improper access control in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable an escalation of privilege via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Atom C3308 · Intel
All versions, or not specified · source: NVD
AC
Atom C3336 · Intel
All versions, or not specified · source: NVD
AC
Atom C3338 · Intel
All versions, or not specified · source: NVD
AC
Atom C3338r · Intel
All versions, or not specified · source: NVD
AC
Atom C3436l · Intel
All versions, or not specified · source: NVD
AC
Atom C3508 · Intel
All versions, or not specified · source: NVD
AC
Atom C3538 · Intel
All versions, or not specified · source: NVD
AC
Atom C3558 · Intel
All versions, or not specified · source: NVD
AC
Atom C3558r · Intel
All versions, or not specified · source: NVD
AC
Atom C3708 · Intel
All versions, or not specified · source: NVD
AC
Atom C3750 · Intel
All versions, or not specified · source: NVD
AC
Atom C3758 · Intel
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-0091
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-0091
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220210-0007/
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00527.html
More from Atom C3308
7.8
CVE-2021-0099
Insufficient control flow management in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable an escalation of privilege via local access
6.8
CVE-2021-33150
Hardware allows activation of test or debug logic at runtime for some Intel(R) Trace Hub instances which may allow an unauthenticated user to potentially enable escalation of…
6.7
CVE-2021-0115
Buffer overflow in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access
6.7
CVE-2021-0111
NULL pointer dereference in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access
6.7
CVE-2021-0107
Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access