Lucene search

IntelVULNRICHMENT:CVE-2023-28396

HistoryFeb 14, 2024 - 1:37 p.m.

CVE-2023-28396

2024-02-1413:37:49

CWE-284

intel

github.com

intel

thunderbolt controllers

firmware

access control

denial of service

local access

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:H

AI Score

6.8

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Improper access control in firmware for some Intel® Thunderbol™ Controllers versions before 41 may allow a privileged user to enable denial of service via local access.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Intel(R) Thunderbol(TM) Controllers versions",
    "versions": [
      {
        "status": "affected",
        "version": "before 41"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00895.html

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:H

AI Score

6.8

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-28396