The latest security information on Intel® products.

Summary: 

Potential security vulnerabilities in the Sub-Page write Permissions (SPP) for some Intel® Processors may allow escalation of privilege. Intel is releasing prescriptive guidance to address these potential vulnerabilities.

Vulnerability Details: 

CVEID:  CVE-2024-36242

Description: Protection mechanism failure in the SPP for some Intel® Processors may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score 3.1: 8.8 High

CVSS Vector 3.1:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS Base Score 4.0: 7.3 High

CVSS Vector 4.0:  CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVEID:  CVE-2024-38660

Description: Protection mechanism failure in the SPP for some Intel® Xeon® processor family (E-Core) may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score 3.1: 3.8 Low

CVSS Vector 3.1:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

CVSS Base Score 4.0: 2.0 Low

CVSS Vector 4.0:  CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Products:

Recommendation:

Intel provided recommendations for Virtual Machine Monitor (VMM, hypervisor) software in virtualized environments. Intel is not aware of any mainstream VMM software that enables SPP. There is no action required in non-virtualized environments or where SPP is not used. 

Acknowledgements:

These issues were found internally by Intel employees. Intel would like to thank Paul Grosen.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.