The latest security information on Intel® products.

BMC Firmware Vulnerability Intel Server Boards, Compute Modules and Systems

Summary:

BMC Firmware in Intel server boards, compute modules, and systems potentially allow an attacker with administrative privileges to make unauthorized read\writes to the SMBUS.
•    8.2 High CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products:

Recommendations:

Intel recommends that customers impacted by this Public Security Advisory upgrade to the latest firmware release for your specific platform as indicated in the list below. Contact your Intel Support representative for details of the release and schedule.
For systems based on the Intel® Server Board S2600BP family, the platform firmware package is available here, and is "00.01.0013":
·         SUP (EFI Shell) https://downloadcenter.intel.com/download/27633
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27637
For systems based on the Intel® Server Board S2600WF family, the platform firmware package is available here, and is "00.01.0013":
·         SUP (EFI Shell) https://downloadcenter.intel.com/download/27632
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27642
For systems based on the Intel® Server Board S2600ST family, the platform firmware package is available here, and is "00.01.0013":
·         SUP (EFI Shell) https://downloadcenter.intel.com/download/27672
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27643
For systems based on the Intel® Server Board S7200AP family, the platform firmware package is available here, and is "R01.03.0018":
·         SUP (EFI Shell)  https://downloadcenter.intel.com/download/27644
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27645
For systems based on the Intel® Server Board S2600TP family, the platform firmware package is available here, and is "R01.01.0024":
·         SUP (EFI Shell) https://downloadcenter.intel.com/download/27575
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27620
For systems based on the Intel® Server Board S2600KP family, the platform firmware package is available here, and is "R01.01.0024":
·         SUP (EFI Shell)  https://downloadcenter.intel.com/download/27574
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27619
For systems based on the Intel® Server Board S2600CW family, the platform firmware package is available here, and is "R01.01.0024":
·         SUP (EFI Shell)  https://downloadcenter.intel.com/download/27577
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27624
For systems based on the Intel® Server Board S2600WT family, the platform firmware package is available here, and is "R01.01.0024":
·         SUP (EFI Shell)  https://downloadcenter.intel.com/download/27576
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27634

Acknowledgements:

This issue was discovered by Intel during internal validation.

CVE Name: CVE-2018-3651