CVE-2023-22293

EUVD-2023-26457 · Published Feb 14, 2024

Improper access control in the Intel(R) Thunderbolt(TM) DCH drivers for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.

Technologies

Intel Core I9-9900TIntel Core I7-6820HqIntel Core I3-6100TIntel Core I5-8269UIntel Core I7-9700KfIntel Core I5-9600Intel Core I5-9500EIntel Core I5-9500FIntel Core I3-6300TIntel Core I5-7600TIntel Core I7-7567UIntel Core I3-9100HlIntel Core M3-8100YIntel Core I3-9350KIntel Core I7-6785RIntel Core I3-7320Intel Core I3-8145UIntel Core I5-8500TIntel Core I7-9750HIntel Core I3-8109UIntel Core I7-9750HfIntel Core I9-9900KsIntel Core I7-8650UIntel Core I7-6822EqIntel Core I5-6350HqIntel Core I5-9600TIntel Core I3-6100Intel Core I3-7300Intel Core I3-9300TIntel Core I3-6098PIntel Core I3-6100HIntel Core I5-7Y57Intel Core I3-7101TeIntel Core I5-6400Intel Core I7-6820EqIntel Core I7-6970HqIntel Core I3-7130UIntel Core I5-6585RIntel Core I3-8145UeIntel Core I7-7Y75Intel Core I3-9300Intel Core I5-6300HqIntel Core I5-7287UIntel Core I3-6300Intel Core I7-8559UIntel Core I3-6100UIntel Core I7-6920HqIntel Core I7-7700HqIntel Core I9-9900KfIntel Core I3-8130UIntel Core I5-8250UIntel Core I5-8265UIntel Core I5-8257UIntel Core I3-6157UIntel Core I7-9700KIntel Core I3-7100EIntel Core I7-7700KIntel Core I3-6100TeIntel Core I7-6500UIntel Core I5-7600Intel Core I5-6287UIntel Core I5-8200YIntel Core I5-7442EqIntel Core I5-8305GIntel Core I5-9600KIntel Core I5-9300HIntel Core I5-8365UeIntel Core I5-8600Intel Core I7-7820EqIntel Core I3-6100EIntel Core I5-7260UIntel Core I5-9400FIntel Core I7-9700FIntel Core I5-7300HqIntel Core I5-7Y54Intel Core I5-6200UIntel Core I5-6500TIntel Core I5-8350UIntel Core I7-6567UIntel Core I5-9300HfIntel Core I7-7600UIntel Core I7-7660UIntel Core I5-9400Intel Core I7-6700HqIntel Core I7-8750HIntel Core I7-9850HeIntel Core I5-6300UIntel Core I7-7560UIntel Core I5-9500Intel Core I5-8259UIntel Core I5-8310YIntel Core I5-8400TIntel Core M3-6Y30Intel Core I3-7102EIntel Core I5-8210YIntel Core I5-8600TIntel Core I3-7100TIntel Core I7-7700Intel Core I3-7100HIntel Core I5-6442EqIntel Core I3-9320Intel Core I3-6102EIntel Core I7-8565UIntel Core I7-8557UIntel Core I5-7500Intel Core I5-8279UIntel Core I5-7500TIntel Core I5-6600Intel Core I7-6700TeIntel Core I5-9500TeIntel Core I7-9700Intel Core I5-8365UIntel Core M3-7Y30Intel Core I5-6500TeIntel Core I7-7820HqIntel Core I5-9600KfIntel Core I7-7820HkIntel Core I7-7700TIntel Core M5-6Y54Intel Core I5-7400Intel Core I9-9900KIntel Core I5-6400TIntel Core I3-9100Intel Core I3-7020UIntel Core I7-8850HIntel Core I7-8706GIntel Core I5-9400TIntel Core I7-8665UIntel Core I7-9850HIntel Core I3-7101EIntel Core I7-8809GIntel Thunderbolt Dch DriverIntel Core I7\+8700Intel Core M5-6Y57Intel Core I5-9500TIntel Core I5-6440HqIntel Core I5-6685RIntel Core I9-8950HkIntel Core I5-6260UIntel Core I5-8300HIntel Core I3-7300TIntel Core I5-7267UIntel Core I9-9980HkIntel Core I7-9850HlIntel Core I9-9880HIntel Core I7-8700KIntel Core I7-8086KIntel Core I3-6167UIntel Core I5-8260UIntel Core I5-9400HIntel Core I7-8705GIntel Core I7-9700TIntel Core I3-9100FIntel Core I7-6700Intel Core I5-8500Intel Core I7-8500YIntel Core I5-8400Intel Core I7-6660UIntel Core I7-8700BIntel Core I7-8709GIntel Core I9-9900Intel Core I5-6600KIntel Core I5-6402PIntel Core I7-8700Intel Core I5-7440EqIntel Core I3-8300TIntel Core I5-6600TIntel Core I7-9700TeIntel Core I3-7100UIntel Core I7-6700KIntel Core I5-6500Intel Core I5-8400BIntel Core I7-6650UIntel Core I3-6320Intel Core I3-8100BIntel Core I3-8300Intel Core I3-9100TeIntel Core I7-6870HqIntel Core I5-6267UIntel Core I5-7400TIntel Core I7-9700EIntel Core I7-6560UIntel Core I3-8100HIntel Core I5-8500BIntel Core I3-8140UIntel Core I5-7200UIntel Core I7-6700TIntel Core I3-9100TIntel Core I3-7350KIntel Core I5-6440EqIntel Core I7-8665UeIntel Core I5-7600KIntel Core I5-6360UIntel Core I5-7440HqIntel Core I7-6600UIntel Core I3-9100EIntel Core I3-7100Intel Core I5-8600KIntel Core I5-7300UIntel Core I7-8550UIntel Core I3-7167UIntel Core I3-8350KIntel Core I5-8400HIntel Core I3-9350KfIntel Core I7-7500UIntel Core M7-6Y75Intel Core I7-7920HqIntel Core I5-7360UIntel Core I7-6820HkIntel Core I7-8569UIntel Core I7-6770HqIntel Core I3-6006UIntel Core I7-8700TIntel Core I3-8100TIntel Core I3-8100Intel Core M3-7Y32

Weaknesses

CWE-284

CVSS scores

v3.18.2CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Privilege Escalation

T1068Exploitation for Privilege Escalation

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html

Potentially impacted assets

See if this affects your attack surface

Latest trending attack

Criticaltoday

Google Brotli decoder - Remote Code Execution via compressed requests (Exploitation Check)

This control is the second step of the Patrowl response to CVE-2026-111497 (Node2Shell). It complements the first control of 22 October 2026, which focused on the Node.js runtime, and does not replace it. Why a second control CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder, the library that decompresses Brotli ("br") data. It was first published as a Node.js vulnerability, because Node.js bundles this decoder. Later publications showed that the flaw is in the library itself. Every product that embeds an affected version of the decoder is concerned, whatever its language or vendor. A public proof of concept demonstrates code execution. Any server that decompresses request bodies sent with "Content-Encoding: br" exposes the decoder to unauthenticated attackers. Known cases include Express 5 and NestJS 11 on Node.js, Koa and Fastify setups, Bun, Envoy and Istio with request decompression enabled, and any application or reverse proxy that decodes Brotli request bodies with an affected library. The flaw also works in the other direction. A malicious server can compromise an unpatched client that decodes a Brotli response, for example Node.js fetch(), Python clients (requests, httpx, aiohttp, Scrapy) with the Brotli or brotlicffi package, or libcurl builds with Brotli support. What this control checks Patrowl sends small, valid Brotli-compressed requests to each asset and observes whether the server decodes them. The check does not depend on the technology: it detects the behaviour, whatever the stack behind it. These requests are what any legitimate client could send. They never reach the vulnerable code path and cannot affect the availability of the service. How to read the result Potentially impacted means the asset decodes Brotli request bodies: the attack surface is exposed. It does not confirm that the asset is vulnerable. The version of the Brotli decoder in use is not visible from the outside. This check covers applications that parse request bodies on their root path. A Not impacted result does not rule out exposure on other routes, nor on the client side. Checking the versions on the servers remains the only exhaustive verification. Two situations are possible. When the decoding is done by your own application or reverse proxy, identify the component and update it. If an update is not possible right away, reject requests with "Content-Encoding: br" at the reverse proxy or WAF. When the asset is hosted on a managed platform or behind a CDN (for example Platform.sh, Upsun or Fastly), the decoding may be done by the provider's edge router, in front of your application. You cannot patch it yourself, but this router handles all the traffic of your site. Ask your provider to confirm that its edge components are patched against CVE-2026-111497. Assets hosted on a managed platform or behind a CDN carry the tag "paas: platform.sh" or "cdn: fastly" in the asset view: for these assets, the Brotli decoding is done by the provider's edge router, in front of your application, and only the provider can patch it. Affected and fixed versions Google Brotli 1.0.3 to 1.2.0 are affected, fixed in 1.0.10, 1.1.1 and 1.2.1. Fixed releases of the main products embedding it: Node.js 22.23.4, 24.22.1 and 26.12.1 (end-of-life lines 20.x and older and 25.x receive no fix), Bun 1.4.4, Envoy 1.37.8, 1.38.6, 1.39.3 and 1.40.0, Istio 1.29.9, 1.30.6 and 1.31.2, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Products that link against the system library depend on the Brotli package of the Linux distribution. Recommendations Update every component that embeds the Brotli decoder (only real fix). Start with the assets flagged by this control. Restart the processes after the update. Rebuild containers, single-executable applications and appliances that bundle an affected runtime or library. Reduce the exposure until the update is deployed. Reject requests with "Content-Encoding: br" at the reverse proxy, load balancer or WAF, case-insensitively and including lists such as "gzip, br". On Envoy and Istio, disable request decompression for Brotli. Contact your edge provider about the status of the pathing (Fastly / Plateform.sh) Review outbound calls. List the features that fetch content from servers you do not control, and patch the services that host them first.

CVE-2023-22293

Technologies

Weaknesses

CVSS scores

MITRE ATT&CK

References

Potentially impacted assets

Latest trending attack

Google Brotli decoder - Remote Code Execution via compressed requests (Exploitation Check)

Our latest news

PHP2Shell: Two Critical RCE Flaws in PHP (CVSS 9.2)

Manage External Security Across All Your Entities

Will AI Become the Next Hacker? Bruce Schneier Answers at DEF CON 34

Take 15 minutes to discover our platform with our experts