CVE-2021-33077 : Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R)

Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

Published 2022-05-12 17:15:09

Updated 2022-07-12 17:42:04

Source Intel Corporation

View at NVD, CVE.org

Products affected by CVE-2021-33077

Intel » Optane Ssd Dc P4800x Firmware
Versions before (<) e2010600
cpe:2.3:o:intel:optane_ssd_dc_p4800x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Optane Ssd Dc P4800x » Version: N/A
Intel » Optane Ssd 905p Firmware
Versions before (<) fw600
cpe:2.3:o:intel:optane_ssd_905p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Optane Ssd 905p » Version: N/A
Intel » Optane Ssd 900p Firmware
Versions before (<) fw600
cpe:2.3:o:intel:optane_ssd_900p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Optane Ssd 900p » Version: N/A
Intel » Optane Ssd Dc P4801x Firmware
Versions before (<) e2010600
cpe:2.3:o:intel:optane_ssd_dc_p4801x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Optane Ssd Dc P4801x » Version: N/A
Intel » Optane Ssd P5800x Firmware
Versions before (<) l0310200
cpe:2.3:o:intel:optane_ssd_p5800x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Optane Ssd P5800x » Version: N/A
Intel » Optane Memory H20 With Solid State Storage Firmware
Versions before (<) pgf028k
cpe:2.3:o:intel:optane_memory_h20_with_solid_state_storage_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Optane Memory H20 With Solid State Storage » Version: N/A
Intel » Optane Memory H10 With Solid State Storage Firmware
Versions before (<) tgf061k
cpe:2.3:o:intel:optane_memory_h10_with_solid_state_storage_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Optane Memory H10 With Solid State Storage » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-33077

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 24 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-33077

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.8	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	0.9	5.9	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2021-33077

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00563.html

INTEL-SA-00563
Mitigation;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-33077

Products affected by CVE-2021-33077

Exploit prediction scoring system (EPSS) score for CVE-2021-33077

CVSS scores for CVE-2021-33077

References for CVE-2021-33077