System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local pr

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• intel core i32100
• intel core i32100t
• intel core i32102
• intel core i32105
• intel core i32115c
• intel core i32120
• intel core i32120t
• intel core i32125
• intel core i32130
• intel core i32310e
• intel core i32310m
• intel core i32312m
• intel core i32328m
• intel core i32330e
• intel core i32330m
• intel core i32340ue
• intel core i32348m
• intel core i32350m
• intel core i32357m
• intel core i32365m

Versions reported by the vendor

Affected version ranges reported by the assigning authority (intel). Independent of NVD's CPE analysis and usually ahead of it.

• Intel Corporation Intel Core-based microprocessors

  • Allaffected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2018-3615Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosu
  31Monitor
• CVE-2018-12169Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Process
  30Monitor
• CVE-2017-5704Platform sample code firmware included with 4th Gen Intel Core Processor, 5th Gen Intel Core Processor, 6th Gen Intel Core Processor, and 7t
  26Monitor
• CVE-2018-3646Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information resid
  25Monitor
• CVE-2018-3620Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information resid
  24Monitor
• CVE-2020-24491Debug message containing addresses of memory transactions in some Intel(R) 10th Generation Core Processors supporting SGX may allow a privil
  17Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.