CVE-2020-12311 Information disclosure in Intel(R) Client SSDs and some Intel(R) Data Center SSDs
An unauthenticated attacker with physical access can exploit insufficient control flow management in Intel SSD firmware to disclose sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12311?
CVE-2020-12311 is a medium-severity vulnerability in Intel(R) Client SSDs and some Intel(R) Data Center SSDs, published on 12 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient control flow managementin firmware in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via physical access.
Which versions are affected by CVE-2020-12311?
It affects 15 products.
Products include Intel Optane Ssd 900p Firmware, Intel Optane Ssd 905p Firmware, Intel Ssd 660p Firmware, Intel Ssd 760p Firmware, Intel Ssd Dc P4101 Firmware, Intel Ssd Dc P4510 Firmware and 9 more.
How do I fix CVE-2020-12311?
No fix has been published for CVE-2020-12311 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-12311 being exploited?
There is no known exploitation of CVE-2020-12311 in the wild and no public exploit code.
Other vulnerabilities in Intel(R) Client SSDs and some Intel(R) Data Center SSDs
- CVE-2020-0584 Memory corruption in Intel(R) SSD DC P4800X and P4801X Series, Intel(R) Optane(TM) SSD 900P and 905P Series
- CVE-2020-12309 Hardcoded credentials in Intel(R) Client SSDs and some Intel(R) Data Center SSDs
- CVE-2020-12310 Information disclosure in Intel(R) Client SSDs and some Intel(R) Data Center SSDs
Sources
Also known as GHSA-p3pg-37qc-49qw.