The latest security information on Intel® products.

Intel® Stratix® 10 FPGA for Intel® Quartus® Prime Pro Advisory

Summary: 

Potential security vulnerabilities in the Intel® Stratix® 10 FPGA firmware provided with Intel® Quartus® Prime Pro software may allow privilege escalation and/or information disclosure.  Intel is releasing software updates to mitigate these potential vulnerabilities.

Vulnerability Details

CVEID: CVE-2020-8737

Description: Improper buffer restrictions in the Intel(R) Stratix(R) 10 FPGA firmware provided with the Intel(R) Quartus(R) Prime Pro software before version 20.1 may allow an unauthenticated user to potentially enable escalation of privilege and/or information disclosure via physical access.

CVSS Base Score: 7.3 High

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVEID: CVE-2020-12312

Description: Improper buffer restrictions in the Intel(R) Stratix(R) 10 FPGA firmware provided with the Intel(R) Quartus(R) Prime Pro software before version 20.2 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

CVSS Base Score: 4.9 Medium

CVSS Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Affected Products:

Intel® Quartus® Prime Pro before version 20.2.

Recommendations:

Intel recommends taking the following steps in order to mitigate this potential vulnerability. Detailed instructions are provided in the application note AN-923 Updating Intel® Stratix® 10 FPGA Firmware.

·         Update Intel® Quartus® Prime Pro to 20.2 or later.

·         Update Intel Stratix® 10 FPGA firmware.

·         Intel recommends cancelling Intel® Stratix® 10 FPGA firmware key cancellation IDs for all prior versions of firmware, which includes IDs 0 through 6. If the AES root key was programmed using firmware from Intel® Quartus® Prime Pro software version 19.4 or earlier, contact Intel Support. Refer to this user guide for details.

Updates to Intel® Quartus® Prime Pro are available for download at this location: https://fpgasoftware.intel.com/?edition=pro

Acknowledgements:

This issue was found internally by Intel employees.  Intel would like to thank Greg Alexander.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.