CVE-2020-8737 Memory corruption in Intel(R) Stratix(R) 10 FPGA firmware provided with the Intel(R) Quartus(R) Prime Pro software
Unauthenticated attackers with physical access can exploit buffer restrictions in Intel Stratix 10 FPGA firmware to escalate privileges or disclose information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8737?
CVE-2020-8737 is a medium-severity memory corruption vulnerability in Intel(R) Stratix(R) 10 FPGA firmware provided with the Intel(R) Quartus(R) Prime Pro software, published on 12 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper buffer restrictions in the Intel(R) Stratix(R) 10 FPGA firmware provided with the Intel(R) Quartus(R) Prime Pro software before version 20.1 may allow an unauthenticated user to potentially enable escalation of privilege and/or information disclosure via physical access.
Which versions are affected by CVE-2020-8737?
It affects 2 products.
Products include Intel Quartus Prime, Intel Stratix 10 Fpga Firmware.
How do I fix CVE-2020-8737?
No fix has been published for CVE-2020-8737 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-8737 being exploited?
There is no known exploitation of CVE-2020-8737 in the wild and no public exploit code.
Other vulnerabilities in Intel(R) Stratix(R) 10 FPGA firmware provided with the Intel(R) Quartus(R) Prime Pro software
- CVE-2021-44454 Privilege escalation in Intel(R) Quartus(R) Prime Pro Edition
- CVE-2022-21174 Privilege escalation in Intel(R) Quartus(R) Prime Pro Edition
- CVE-2022-21203 Privilege escalation in Intel(R) Quartus(R) Prime Standard Edition
- CVE-2022-21204 Privilege escalation in Intel(R) Quartus(R) Prime Pro Edition
- CVE-2022-21220 XML external entity in Intel(R) Quartus(R) Prime Pro Edition
Sources
Also known as GHSA-wxq2-wrr8-f54g.