Medium severity · published May 12, 2022
CVE-2021-33080
Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products…
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products may allow an unauthenticated user to potentially enable information disclosure or escalation of privilege via physical access.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OM
Optane Memory H10 With Solid State Storage Firmware · Intel
before tgf061k · source: NVD
OM
Optane Memory H20 With Solid State Storage Firmware · Intel
before pgf028k · source: NVD
OS
Optane Ssd 900p Firmware · Intel
before fw600 · source: NVD
OS
Optane Ssd 905p Firmware · Intel
before fw600 · source: NVD
OS
Optane Ssd DC P4800x Firmware · Intel
before e2010600 · source: NVD
OS
Optane Ssd DC P4801x Firmware · Intel
before e2010600 · source: NVD
OS
Optane Ssd P5800x Firmware · Intel
before l0310200 · source: NVD
Affected product
OM
Optane Memory H10 With Solid State Storage Firmware
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33080
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33080
Mitigation
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00563.html
Broken Link
https://www.solidigm.com/content/dam/newco-aem-site/master/site/support/Solidigm%20SA-000563%20rev1.1.pdf
More from Optane Memory H10 With Solid State Storage Firmware
6.8
CVE-2021-33077
Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow an unauthenticated user to potentially…
5.5
CVE-2021-33069
Improper resource shutdown or release in firmware for some Intel(R) SSD, Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC may allow a privileged user to…
4.7
CVE-2021-33078
Race condition within a thread in firmware for some Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow a privileged user to potentially enable denial of service via…
4.7
CVE-2021-33075
Race condition in firmware for some Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow a privileged user to potentially enable denial of…
4.6
CVE-2021-33082
Sensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and Intel(R) Optane(TM) SSD Products may allow an unauthenticated user to potentially…