CVE-2020-12360
📋 TL;DR
This vulnerability is an out-of-bounds read in Intel processor firmware that allows authenticated local users to potentially escalate privileges. It affects specific Intel processors and requires local access to exploit. The flaw could enable attackers to read sensitive memory contents and gain higher system privileges.
💻 Affected Systems
- Intel Processors with specific firmware versions
📦 What is this software?
Aff Bios by Netapp
Bios by Intel
Fas Bios by Netapp
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could achieve full system compromise, gaining root/administrator privileges and accessing sensitive data in memory.
Likely Case
Local authenticated users could escalate privileges to gain unauthorized access to system resources and sensitive information.
If Mitigated
With proper access controls and patching, the risk is significantly reduced to minimal impact on system security.
🎯 Exploit Status
Requires local authenticated access and knowledge of memory layout; firmware-level vulnerabilities typically have higher exploitation complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates provided by Intel and system manufacturers
Vendor Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html
Restart Required: Yes
Instructions:
1. Check Intel advisory for affected processor models. 2. Contact system manufacturer for firmware updates. 3. Apply firmware update following manufacturer instructions. 4. Reboot system to activate new firmware.
🔧 Temporary Workarounds
Restrict local access
allLimit local authenticated access to systems with affected processors
Implement least privilege
allEnsure users have only necessary privileges to reduce impact of potential privilege escalation
🧯 If You Can't Patch
- Isolate affected systems from critical networks and sensitive data
- Implement strict access controls and monitoring for local user activities
🔍 How to Verify
Check if Vulnerable:
Check processor model and firmware version against Intel's advisory listCheck Version:
On Linux: 'sudo dmidecode -t bios' or 'sudo cat /sys/class/dmi/id/bios_version'; On Windows: 'wmic bios get smbiosbiosversion'Verify Fix Applied:
Verify firmware version has been updated to patched version from manufacturer📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts
- Firmware modification attempts
- Suspicious local user activity patterns
Network Indicators:
- Not applicable - local access only vulnerability
SIEM Query:
Search for local privilege escalation events or firmware access attempts from authenticated users🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf
- https://security.netapp.com/advisory/ntap-20210702-0002/
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf
- https://security.netapp.com/advisory/ntap-20210702-0002/
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html
