Medium severity · published Nov 14, 2023
CVE-2023-27879
Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OM
Optane Memory H20 With Solid State Storage Firmware · Intel
before u4110553-g004 · source: NVD
OS
Optane Ssd 905p Firmware · Intel
before e2010650; before e2010650 · source: NVD
OS
Optane Ssd DC P4800x Firmware · Intel
before e2010650 · source: NVD
OS
Optane Ssd DC P4801x Firmware · Intel
before e2010650 · source: NVD
Affected product
OM
Optane Memory H20 With Solid State Storage Firmware
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27879
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27879
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00758.html
More from Optane Memory H20 With Solid State Storage Firmware
7.8
CVE-2023-27519
Improper input validation in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable escalation of privilege via local access
6.8
CVE-2021-33080
Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products…
6.8
CVE-2021-33077
Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow an unauthenticated user to potentially…
5.5
CVE-2023-27306
Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potentially enable denial of service via local access
5.5
CVE-2021-33069
Improper resource shutdown or release in firmware for some Intel(R) SSD, Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC may allow a privileged user to…