CVE-2020-12311: Insufficient control flow managementin firmware in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via ph...

Summary

Insufficient control flow managementin firmware in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via physical access.

What to do

Update intel ssd_pro_6000p_firmware to version psf131p or later.
Update intel ssd_pro_7600p_firmware to version 005p or later.
Update intel ssd_760p_firmware to version 005c or later.
Update intel ssd_e_6100p_firmware to version 005e or later.
Update intel ssd_660p_firmware to version 004c or later.
Update intel optane_ssd_905p_firmware to version e2010480 or later.
Update intel optane_ssd_900p_firmware to version e2010480 or later.
Update intel ssd_dc_p4510_firmware to version vdv10170 or later.
Update intel ssd_dc_p4610_firmware to version vdv10170 or later.
Update intel ssd_dc_p4800x_firmware to version e2010485 or later.
Update intel ssd_dc_p4801x_firmware to version e2010485 or later.
Update intel ssd_dc_p4101_firmware to version 008d or later.

Affected software

Vendor	Product	Affected versions
intel	ssd_pro_6000p_firmware	< psf131p `cpe:2.3:o:intel:ssd_pro_6000p_firmware::::::::`
intel	ssd_pro_5450s_firmware	< lhf005p < lhf0b3p `cpe:2.3:o:intel:ssd_pro_5450s_firmware::::::::`
intel	ssd_e_5100s_firmware	< lhf004e < lhf0ae3 `cpe:2.3:o:intel:ssd_e_5100s_firmware::::::::`
intel	ssd_pro_5400s_firmware	< lbf017p < lsf043p `cpe:2.3:o:intel:ssd_pro_5400s_firmware::::::::`
intel	ssd_pro_7600p_firmware	< 005p `cpe:2.3:o:intel:ssd_pro_7600p_firmware::::::::`
intel	ssd_760p_firmware	< 005c `cpe:2.3:o:intel:ssd_760p_firmware::::::::`
intel	ssd_e_6100p_firmware	< 005e `cpe:2.3:o:intel:ssd_e_6100p_firmware::::::::`
intel	ssd_660p_firmware	< 004c `cpe:2.3:o:intel:ssd_660p_firmware::::::::`
intel	optane_ssd_905p_firmware	< e2010480 `cpe:2.3:o:intel:optane_ssd_905p_firmware::::::::`
intel	optane_ssd_900p_firmware	< e2010480 `cpe:2.3:o:intel:optane_ssd_900p_firmware::::::::`
intel	ssd_dc_p4510_firmware	< vdv10170 `cpe:2.3:o:intel:ssd_dc_p4510_firmware::::::::`
intel	ssd_dc_p4610_firmware	< vdv10170 `cpe:2.3:o:intel:ssd_dc_p4610_firmware::::::::`
intel	ssd_dc_p4800x_firmware	< e2010485 `cpe:2.3:o:intel:ssd_dc_p4800x_firmware::::::::`
intel	ssd_dc_p4801x_firmware	< e2010485 `cpe:2.3:o:intel:ssd_dc_p4801x_firmware::::::::`
intel	ssd_dc_p4101_firmware	< 008d `cpe:2.3:o:intel:ssd_dc_p4101_firmware::::::::`

Original advisory text

Insufficient control flow managementin firmware in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via ph...

Insufficient control flow managementin firmware in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via physical access.

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00362 Vendor Advisory