CVE-2023-31276

CVE-2023-31276 is a heap-based buffer overflow vulnerability (CWE-122) in the Baseboard Management Controller (BMC) firmware for several Intel server boards, including the Intel Server Board S2600WF, S2600ST, and S2600BP prior to version 02.01.0017, as well as the Intel Server Board M50CYP and D50TNP prior to version R01.01.0009. Published on 2025-02-12, it carries a CVSS v3.1 base score of 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts with a changed scope.

A privileged user with local access can exploit this vulnerability by triggering the heap-based buffer overflow in the BMC firmware, potentially enabling escalation of privileges. The attack requires high privileges (PR:H) and local access (AV:L) with low complexity (AC:L) and no user interaction (UI:N), allowing the attacker to gain elevated control over the affected system.

Intel's security advisory (INTEL-SA-00990) details the issue and recommends updating the BMC firmware to version 02.01.0017 or later for the S2600WF, S2600ST, and S2600BP models, and to version R01.01.0009 or later for the M50CYP and D50TNP models as the primary mitigation.