The latest security information on Intel® products.

SINIT Buffer Overflow Vulnerability

Summary: 

Intel® Trusted Execution Technology SINIT Authenticated Code Modules (ACMs) are susceptible to a buffer overflow issue. Intel is providing updated SINIT ACMs to mitigate this issue and microcode updates to revoke vulnerable SINIT ACMs.

Description: 

When Intel® Trusted Execution Technology measured launch is invoked using affected SINIT Authenticated Code Modules (ACMs), the platform is susceptible to an OS-level exploit, which can bypass Intel®TXT compromising certain SINIT ACM functionality, including launch control policy and additionally lead to compromise of System Management Mode (SMM). To mitigate this issue, Intel is releasing updated SINIT ACMs. Additionally, microcode-based revocation of vulnerable SINIT ACMs is being made available for all affected processors.

Affected products:

Recommendations: 

While Intel is not aware of active use of the vulnerability described in this advisory, Intel has made updated SINIT Authenticated Code Modules (ACMs) available at http://software.intel.com/en-us/articles/intel-trusted-execution-technology/ to mitigate this issue. If your BIOS includes an SINIT ACM, which is more common for Intel® TXT server platforms, a BIOS update that includes the updated SINIT ACM should be installed; please contact your platform OEM. Intel is also providing microcode updates, which will revoke vulnerable SINIT ACMs by causing GETSEC[SENTER] to fail.  The BIOS update that contains the new microcode patch should be installed on all affected systems. Note that prior to installing the microcode update, an updated SINIT ACM must be installed to launch your Intel TXT enabled software.  Contact your solutions provider or Intel®TXT software vendor if your Intel®TXT environment fails to launch and to determine how to update your software with the new SINIT ACM. Intel highly recommends that these updates be applied to mitigate this issue.

If SINIT and Microcode updates for your TXT-capable platform are not immediately available Intel recommends you take the following actions to protect your platform:

If Intel®TXT is disabled you are not affected by this issue. If you are not actively running Intel®TXT disable it in the BIOS. Consult your owner’s manual for instructions on how to disable Intel TXT in BIOS.

Once you have confirmed that Intel TXT is disabled on your system, you should:

o   Maintain control of your computing environment. Administrative access, like Ring 0 in a typical operating system, is required to implement this attack.

o   Apply all patches and security updates for your operating system and applications.

o   Ensure that security utilities such as firewalls, antivirus, etcetera are kept current with updates.

Acknowledgements: 

Intel would like to thank Rafal Wojtczuk and Joanna Rutkowska from Invisible Things Lab (http://invisiblethingslab.com) for reporting this issue and working with us.