Intel E810 NVM Update Utility: Insecure inherited permissions in the NVM update utility

Impact

Insecure inherited permissions in the NVM update utility - the tool you run to fix the NIC firmware issues above - let a local authenticated user escalate. Worth noting because the remediation tool being the vulnerability is a genuine operational trap when you push it fleet-wide under automation.

Who can reach it

Authenticated local user on a node where the utility is staged.

What to do

Use NVM Update Utility 4.60 or later, and check permissions on the staging directory your automation copies it into. Userspace tool, no reboot for the tool update itself.

References