CVE-2020-8702:Intel Processor Diagnostic Tool before version 4.1.5.37 contains an uncontrolled search path vulnerability allowing local privilege escalation.

splash
Back

Description Preview

CVE-2020-8702 affects the Intel Processor Diagnostic Tool versions prior to 4.1.5.37. The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element), which allows an authenticated local user to potentially escalate privileges. This occurs because the application does not properly validate or control the search paths it uses to locate and load critical resources or code, enabling an attacker to insert malicious files that will be executed with elevated privileges.

Overview

The Intel Processor Diagnostic Tool is software designed to verify the functionality of Intel processors. The vulnerability exists due to an uncontrolled search path element in the application, which creates a security risk when the application attempts to load resources or executable files. When the application searches for these files without using fully qualified paths, an attacker with local access could place malicious files in the search path, causing the application to load and execute these files with its own privileges. Since the Intel Processor Diagnostic Tool often runs with elevated permissions to access hardware information, this could lead to privilege escalation on affected systems.

Remediation

Users should update the Intel Processor Diagnostic Tool to version 4.1.5.37 or later to address this vulnerability. Intel has released this patched version which properly controls search paths when loading resources and executable files.

Steps for remediation:

  1. Download the latest version of Intel Processor Diagnostic Tool (v4.1.5.37 or newer) from the official Intel website
  2. Uninstall the previous vulnerable version
  3. Install the updated version
  4. Verify the installation was successful by checking the version number in the application's About or Help section

As a general security practice, limit the number of users with administrative privileges on systems where diagnostic tools are installed.

References

  1. Intel Security Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00458.html
  2. CWE-427: Uncontrolled Search Path Element: https://cwe.mitre.org/data/definitions/427.html
  3. MITRE CVE Entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8702

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Educational Services
    Educational Services
  2. Public Administration
    Public Administration
  3. Accommodation & Food Services
    Accommodation & Food Services
  4. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  5. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  6. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  7. Construction
    Construction
  8. Finance and Insurance
    Finance and Insurance
  9. Health Care & Social Assistance
    Health Care & Social Assistance
  10. Information
    Information
  11. Management of Companies & Enterprises
    Management of Companies & Enterprises
  12. Manufacturing
    Manufacturing
  13. Mining
    Mining
  14. Other Services (except Public Administration)
    Other Services (except Public Administration)
  15. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  16. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  17. Retail Trade
    Retail Trade
  18. Transportation & Warehousing
    Transportation & Warehousing
  19. Utilities
    Utilities
  20. Wholesale Trade
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background