CVE-2020-24456
📋 TL;DR
This vulnerability in Intel Board ID Tool v1.01 allows authenticated local users to escalate privileges due to incorrect default permissions. Attackers could gain higher system privileges than intended. Only systems with this specific Intel tool installed are affected.
💻 Affected Systems
- Intel(R) Board ID Tool
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local authenticated attacker gains SYSTEM/root privileges, enabling complete system compromise, data theft, persistence installation, and lateral movement.
Likely Case
Local user with standard privileges gains administrative rights, allowing software installation, configuration changes, and access to protected resources.
If Mitigated
With proper access controls and least privilege principles, impact is limited to the specific user account and tool functionality.
🎯 Exploit Status
Requires local authenticated access. Exploitation likely involves manipulating file permissions or process execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.02 or later
Vendor Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00447
Restart Required: Yes
Instructions:
1. Download Intel Board ID Tool v1.02 or later from Intel's website. 2. Uninstall current version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Remove vulnerable tool
windowsUninstall Intel Board ID Tool v1.01 if not required
Control Panel > Programs > Uninstall a program > Select Intel Board ID Tool > Uninstall
Restrict tool access
windowsApply strict file permissions to tool executables and directories
icacls "C:\Program Files\Intel\Board ID Tool\*" /inheritance:r /grant:r "Administrators:(OI)(CI)F" /grant:r "SYSTEM:(OI)(CI)F"
🧯 If You Can't Patch
- Remove Intel Board ID Tool v1.01 if not essential for operations
- Implement strict access controls and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check installed programs for 'Intel Board ID Tool' version 1.01Check Version:
wmic product where name="Intel Board ID Tool" get versionVerify Fix Applied:
Verify Intel Board ID Tool version is 1.02 or later📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Access to Board ID Tool files by non-admin users
- Process creation with elevated privileges from Board ID Tool
Network Indicators:
- None - local vulnerability only
SIEM Query:
EventID=4688 AND ProcessName="*BoardID*" AND NewProcessName="*cmd*" OR NewProcessName="*powershell*"