The latest security information on Intel® products.

Intel® Baseboard Management Controller (BMC) firmware Advisory

Summary:

A potential security vulnerability in Intel® Baseboard Management Controller (BMC) firmware may allow escalation of privilege or denial of service. Intel is releasing updates for Intel® Baseboard Management Controller (BMC) firmware to mitigate this potential vulnerability.

Vulnerability Details

CVEID: CVE-2018-12171

Description: Privilege escalation in Intel® Baseboard Management Controller (BMC) firmware before version 1.43.91f76955 may allow an unprivileged user to potentially execute arbitrary code or perform denial of service over the network.

CVSS Base Score: 8.3 High

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products:

Recommendations:

Intel recommends that users of affected products upgrade to the latest platform firmware package.

For systems based on the Intel® Server Board S2600BP family, the platform firmware package is available here, and is "00.01.0013":
·         SUP (EFI Shell) https://downloadcenter.intel.com/download/27633
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27637

For systems based on the Intel® Server Board S2600WF family, the platform firmware package is available here, and is "00.01.0013":
·         SUP (EFI Shell) https://downloadcenter.intel.com/download/27632
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27642

For systems based on the Intel® Server Board S2600ST family, the platform firmware package is available here, and is "00.01.0013":
·         SUP (EFI Shell) https://downloadcenter.intel.com/download/27672
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27643

Acknowledgements:

Intel would like to thank Lenovo for reporting this issue and working with us on coordinated disclosure.