CVE-2021-33120 [Medium] | Out-of-bounds Read in Atom P5942b Firmware

Out of bounds read under complex microarchitectural condition in memory subsystem for some Intel Atom(R) Processors may allow authenticated user to potentially enable information disclosure or cause denial of service via network access.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-02-15	0.36%	0.69%	+0.33%
2	2025-10-07	0.30%	0.36%	+0.06%
3	2025-03-30	—	0.30%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-02-15

0.36%

0.69%

+0.33%

2025-10-07

0.30%

0.36%

+0.06%

2025-03-30

—

0.30%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.4	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.	2.8	2.5	[email protected]
5.4	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.	2.8	2.5	134c704f-9b21-4f2e-91b3-4a467353bcc0
5.5	2.0	MEDIUM	`AV:N/AC:L/Au:S/C:P/I:N/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:S) A single authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:N) No integrity impact. Availability impact (A:P) Partial availability impact.	8.0	4.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.4

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:L): Might cause slowdowns, glitches, or partial disruption—not a full brick.

2.8

2.5

[email protected]

5.4

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:L): Might cause slowdowns, glitches, or partial disruption—not a full brick.

2.8

2.5

134c704f-9b21-4f2e-91b3-4a467353bcc0

5.5

2.0

MEDIUM

AV:N/AC:L/Au:S/C:P/I:N/A:P Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:S): A single authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:N): No integrity impact.
Availability impact (A:P): Partial availability impact.

8.0

4.9

[email protected]

OS Trackers for CVE-2021-33120

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2021-33120 not yet assigned priority: Debian including 1 source packages (intel-microcode), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2021-33120
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2021-33120
`suse`	medium	CVE-2021-33120 severity moderate: SUSE including 14 source package names (microcode_ctl, microcode_ctl-1.17-102.83.75.2, …), 74 product×package rows across 74 product lines (HPE Helion OpenStack 8, Image SLES12-SP5-SAP-Azure-LI-BYOS-Production, … (74 product lines)): Fixed 73, Known Not Affected 1.	https://www.suse.com/security/cve/CVE-2021-33120/
`ubuntu`	medium	CVE-2021-33120 medium priority: Ubuntu including 1 source packages (intel-microcode), 8 status rows across 8 suites (bionic, focal, impish, jammy, kinetic, trusty, upstream, xenial): released 7, ignored 1.	https://ubuntu.com/security/CVE-2021-33120

Affected software / configurations for CVE-2021-33120

Vendor	Product	Version	Raw CPE
intel	atom_p5942b_firmware	—	cpe:2.3:o:intel:atom_p5942b_firmware:-:::::::*
intel	atom_p5931b_firmware	—	cpe:2.3:o:intel:atom_p5931b_firmware:-:::::::*
intel	atom_p5962b_firmware	—	cpe:2.3:o:intel:atom_p5962b_firmware:-:::::::*
intel	atom_p5921b_firmware	—	cpe:2.3:o:intel:atom_p5921b_firmware:-:::::::*
intel	xeon_d1700_firmware	—	cpe:2.3:o:intel:xeon_d1700_firmware:-:::::::*
intel	xeon_d2700_firmware	—	cpe:2.3:o:intel:xeon_d2700_firmware:-:::::::*
intel	core_i5-l16g7_firmware	—	cpe:2.3:o:intel:core_i5-l16g7_firmware:-:::::::*
intel	core_i3-l13g4_firmware	—	cpe:2.3:o:intel:core_i3-l13g4_firmware:-:::::::*
intel	pentium_j6425_firmware	—	cpe:2.3:o:intel:pentium_j6425_firmware:-:::::::*
intel	pentium_n6415_firmware	—	cpe:2.3:o:intel:pentium_n6415_firmware:-:::::::*
intel	celeron_j6413_firmware	—	cpe:2.3:o:intel:celeron_j6413_firmware:-:::::::*
intel	celeron_n6211_firmware	—	cpe:2.3:o:intel:celeron_n6211_firmware:-:::::::*
intel	atom_x6413e_firmware	—	cpe:2.3:o:intel:atom_x6413e_firmware:-:::::::*
intel	atom_x6425re_firmware	—	cpe:2.3:o:intel:atom_x6425re_firmware:-:::::::*
intel	atom_x6427fe_firmware	—	cpe:2.3:o:intel:atom_x6427fe_firmware:-:::::::*
intel	atom_x6212re_firmware	—	cpe:2.3:o:intel:atom_x6212re_firmware:-:::::::*
intel	atom_x6200fe_firmware	—	cpe:2.3:o:intel:atom_x6200fe_firmware:-:::::::*
intel	atom_x6211e_firmware	—	cpe:2.3:o:intel:atom_x6211e_firmware:-:::::::*
intel	atom_x6425e_firmware	—	cpe:2.3:o:intel:atom_x6425e_firmware:-:::::::*
intel	pentium_silver_n6005_firmware	—	cpe:2.3:o:intel:pentium_silver_n6005_firmware:-:::::::*
intel	pentium_silver_n6000_firmware	—	cpe:2.3:o:intel:pentium_silver_n6000_firmware:-:::::::*
intel	celeron_n4505_firmware	—	cpe:2.3:o:intel:celeron_n4505_firmware:-:::::::*
intel	celeron_n4500_firmware	—	cpe:2.3:o:intel:celeron_n4500_firmware:-:::::::*
intel	celeron_n5105_firmware	—	cpe:2.3:o:intel:celeron_n5105_firmware:-:::::::*
intel	celeron_n5100_firmware	—	cpe:2.3:o:intel:celeron_n5100_firmware:-:::::::*

References for CVE-2021-33120

URL	Tags
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00589.html	Mitigation Vendor Advisory

URL

CVE-2021-33120

Exploit prediction scoring system (EPSS) score for CVE-2021-33120

Common vulnerability scoring system (CVSS) metrics for CVE-2021-33120

Weakness enumeration for CVE-2021-33120

OS Trackers for CVE-2021-33120

Affected software / configurations for CVE-2021-33120

References for CVE-2021-33120