CVE-2023-34349 Race condition in Intel(R) NUC BIOS firmware
A race condition in Intel NUC BIOS firmware allows a privileged local user to escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-34349?
CVE-2023-34349 is a medium-severity vulnerability in Intel(R) NUC BIOS firmware, published on 11 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Which versions are affected by CVE-2023-34349?
It affects 174 products.
Products include Intel Nuc 11 Compute Element Cm11ebc4w Firmware, Intel Nuc 11 Compute Element Cm11ebi38w Firmware, Intel Nuc 11 Compute Element Cm11ebi58w Firmware, Intel Nuc 11 Compute Element Cm11ebi716w Firmware, Intel Nuc 11 Performance Kit Nuc11pahi30z Firmware, Intel Nuc 11 Performance Kit Nuc11pahi3 Firmware and 168 more.
How do I fix CVE-2023-34349?
No fix has been published for CVE-2023-34349 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-34349 being exploited?
There is no known exploitation of CVE-2023-34349 in the wild and no public exploit code.
Other vulnerabilities in Intel(R) NUC BIOS firmware
- CVE-2023-22449 Privilege escalation in Intel(R) NUC BIOS firmware
- CVE-2023-22330 Information disclosure in Intel(R) NUC BIOS firmware
- CVE-2023-22356 Information disclosure in Intel(R) NUC BIOS firmware
- CVE-2023-22444 Information disclosure in Intel(R) NUC 13 Extreme Compute Element, Intel(R) NUC 13 Extreme Kit, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board and Intel(R) NUC Pro Mini PC BIOS firmware
Sources
Also known as GHSA-hgvj-cw5w-8qg3.