PT-2021-2031 · Intel · Intel Optane Dc Persistent Memory Installer For Windows

Published 2021-02-09 · Updated 2021-02-23 · CVE-2020-24451

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Intel(R) Optane(TM) DC Persistent Memory installer for Windows versions prior to 1.00.00.3506

Description: The issue is related to an uncontrolled search path in the installer, which may allow an authenticated user to potentially enable escalation of privilege via local access. This is due to incorrect handling of the search path. An attacker could exploit this to gain elevated privileges.

Recommendations: For versions prior to 1.00.00.3506, update to version 1.00.00.3506 or later to resolve the issue.

Fix

Uncontrolled Search Path Element

Untrusted Search Path

Weakness Enumeration

CWE-427

CWE-426

Related Identifiers

BDU:2021-00867

CVE-2020-24451

Affected Products

Intel Optane Dc Persistent Memory Installer For Windows

References · 5

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00436.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00867 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24451 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24451 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021021603 · Note