Improper buffer restrictions in firmware for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• intel compute stick stck1a32wfc firmwarestck1a32wfc
• intel compute stick stck1a8lfc firmwarestck1a8lfc
• intel compute stick stk1a32sc firmwaresc0045
• intel compute stick stk1aw32sc firmwaresc0045
• intel compute stick stk2m364cc firmwareccsklm30.86a.0062
• intel compute stick stk2m3w64cc firmwareccsklm30.86a.0062
• intel nuc 7 enthusiast pc nuc7i7bnhxg firmwarebnkbl357.86a.0081
• intel nuc 7 essential pc nuc7cjysal firmwarejyglkcpx.86a.0053
• intel nuc 7 home a mini pc nuc7i3bnhxf firmwarebnkbl357.86a.0081
• intel nuc 7 home a mini pc nuc7i5bnhxf firmwarebnkbl357.86a.0081
• intel nuc 7 home a mini pc nuc7i5bnkp firmwarebnkbl357.86a.0081
• intel nuc 8 business pc nuc8i7hnkqc firmwarehnkbli70.86a.0059
• intel nuc 8 enthusiast pc nuc8i7bekqa firmwarebecfl357.86a.0077
• intel nuc 8 home pc nuc8i3cysm firmwarecycnli35.86a.0044
• intel nuc 8 mainstream-g kit nuc8i5inh firmwareinwhl357.0036
• intel nuc 8 mainstream-g kit nuc8i7inh firmwareinwhl357.0036
• intel nuc 8 mainstream-g mini pc nuc8i7inh firmwareinwhl357.0036
• intel nuc 8 rugged kit nuc8cchkr firmwarechaplcel.0047
• intel nuc board d34010wyb firmwarewylpt10h.86a.0054
• intel nuc board d54250wyb firmwarewylpt10h.86a.0054

Versions reported by the vendor

Affected version ranges reported by the assigning authority (intel). Independent of NVD's CPE analysis and usually ahead of it.

• Intel Intel(R) NUC Firmware

  • See advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00343.htmlaffected

Other highest-scoring records for the same primary product.

• CVE-2020-0526Improper input validation in firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege via local a
  26Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.