The latest security information on Intel® products.

Intel® CSME Assets Advisory

Summary:

A potential security vulnerability in Intel® CSME, Intel® Server Platform Services and Intel® Trusted Execution Engine Firmware may allow information disclosure. Intel is releasing Intel® CSME, Intel® Server Platform Services and Intel® Trusted Execution Engine updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2018-3655

Description: A vulnerability in a subsystem in Intel® CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow an unauthenticated user to potentially modify or disclose information via physical access.

CVSS Base Score: 7.3 High

CVSS Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVEID: CVE-2018-12147

Description: Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.0AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Products:

This vulnerability affects Intel® CSME firmware versions:  11.0 through 11.8.50; 11.10 through 11.11.50; 11.20 through 11.21.51, Intel® Server Platform Services firmware version 4.0 (on Purley and Bakerville only) and Intel® TXE version 3.0 through 3.1.50.

Systems using Intel® CSME firmware versions prior to 11.0/ Intel® Server Platform Services 4.0/TXE 3.0 or using firmware versions 11.8.55/11.11.55/11.21.55/ Intel® Server Platform Services 5.0 and higher/TXE 3.1.55 or higher are not affected by this vulnerability.

An unauthenticated user with physical access could potentially:

•       Bypass Intel® CSME anti-replay protection, which may allow brute force attacks to expose information stored inside the Intel® CSME.  

•       Gain unauthorized access to the Intel® MEBX password.

•       Tamper with the integrity of the Intel® CSME file system directories or the Server Platform Services and Trusted Execution Environment (Intel® TXE) data files.

Mitigations described in INTEL-SA-00086 do not prevent the issue since a user with physical access to the system may be able to roll back to an earlier Intel® CSME firmware affected by CVE-2017-5705, CVE-2017-5706 and CVE-2017-5707.

Recommendations:

Intel recommends that users of Intel® CSME, Intel® Server Platform Service and Intel® Trusted Execution Engine (TXE) update to the latest version provided by the system manufacturer that addresses these issues.

Acknowledgements:

Intel would like to thank Dmitry Sklyarov and Maxim Goryachy from Positive Technologies for reporting this issue and working with Intel Corporation on coordinated public disclosure.  CVE-2018-12147 was found by Intel employees and also subsequently also reported by Maxim Goryachy from Positive Technologies.