Windows 10: Bios update for Intel identified potential security vulnerability in SMI Transfer monitor...

RAJU.MSC.MATHEMATICS · Aug 17, 2024

On 13th August 2024, Intel published in security advisory SA-01083 that a potential security vulnerability in the SMI Transfer monitor STM may allow privilege escalation. Intel is releasing microcode updates to mitigate this potential vulnerability.Affected processors list2nd Generation Intel® Xeon® Scalable processor family 3rd Generation Intel® Xeon® Scalable processor family 6th Generation Intel® Core™ Processor Family 7th Generation Intel® Core™ Processor Family 8th Generation Intel® Core™ Processor Family 9thGeneration Intel® Core™ Processor Family 10th Generation Intel® Core™ Proc

:)

Brink · Aug 17, 2024

Intel NUC Bios Updater Advisory for potential security vulnerability

[table][tr]Intel ID: INTEL-SA-00168 [/tr] [tr][td]Advisory Category:[/td] [td]Software[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Denial of Service, Information Disclosure[/td] [/tr] [tr][td]Severity rating:[/td] [td]HIGH[/td] [/tr] [tr][td]Original release:[/td] [td]10/09/2018[/td] [/tr] [tr][td]Last revised:[/td] [td]10/09/2018[/td] [/tr] [/table]

Summary:

A potential security vulnerability in Intel® NUC EBU firmware update executable may allow denial of service or information disclosure. Intel is releasing firmware kit updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2018-12158

Description: Insufficient input validation in BIOS update utility in Intel(R) NUC FW kits downloaded before May 24, 2018 may allow a privileged user to potentially trigger a denial of service or information disclosure via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Products:

Intel® NUC Firmware Kits downloaded before May 24, 2018.

Recommendations:

Intel recommends users who have downloaded Intel® NUC firmware kits before May 24, 2018 to delete the download.

Updates are available for download at this location: https://downloadcenter.intel.com/product/98414/Mini-PCs

Acknowledgements:

Intel would like to thank Alexander Ermolov of Embedi for reporting this issue and working with us on coordinated disclosure.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]10/09/2018[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00168

Brink · Aug 17, 2024

Intel NUC Bios Updater Advisory for potential security vulnerability

[table][tr]Intel ID: INTEL-SA-00168 [/tr] [tr][td]Advisory Category:[/td] [td]Software[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Denial of Service, Information Disclosure[/td] [/tr] [tr][td]Severity rating:[/td] [td]HIGH[/td] [/tr] [tr][td]Original release:[/td] [td]10/09/2018[/td] [/tr] [tr][td]Last revised:[/td] [td]10/09/2018[/td] [/tr] [/table]

Summary:

A potential security vulnerability in Intel® NUC EBU firmware update executable may allow denial of service or information disclosure. Intel is releasing firmware kit updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2018-12158

Description: Insufficient input validation in BIOS update utility in Intel(R) NUC FW kits downloaded before May 24, 2018 may allow a privileged user to potentially trigger a denial of service or information disclosure via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Products:

Intel® NUC Firmware Kits downloaded before May 24, 2018.

Recommendations:

Intel recommends users who have downloaded Intel® NUC firmware kits before May 24, 2018 to delete the download.

Updates are available for download at this location: https://downloadcenter.intel.com/product/98414/Mini-PCs

Acknowledgements:

Intel would like to thank Alexander Ermolov of Embedi for reporting this issue and working with us on coordinated disclosure.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]10/09/2018[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00168

Brink · Aug 17, 2024

Potential security vulnerabilities in Intel firmware

[table][tr]Intel ID: INTEL-SA-00191 [/tr] [tr][td]Advisory Category:[/td] [td]Firmware[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Escalation of Privilege, Denial of Service, Information Disclosure[/td] [/tr] [tr][td]Severity rating:[/td] [td]HIGH[/td] [/tr] [tr][td]Original release:[/td] [td]03/12/2019[/td] [/tr] [tr][td]Last revised:[/td] [td]03/12/2019[/td] [/tr] [/table]

Summary:

Multiple potential security vulnerabilities in Intel firmware may allow for escalation of privilege, information disclosure or denial of service. Intel is releasing firmware updates to mitigate these potential vulnerabilities.

Vulnerability Details:

CVEID: CVE-2018-12201
Description: Buffer overflow vulnerability in Platform Sample / Silicon Reference firmware for 8th Generation Intel(R) Core™ Processor, 7th Generation Intel(R) Core™ Processor, Intel(R) Pentium(R) Silver J5005 Processor, Intel(R) Pentium(R) Silver N5000 Processor, Intel(R) Celeron(R) J4105 Processor, Intel(R) Celeron(R) J4005 Processor, Intel® Celeron(R) N4100 Processor and Intel(R) Celeron® N4000 Processor may allow privileged user to potentially execute arbitrary code via local access.
CVSS Base Score: 5.7 Medium
CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H

CVEID: CVE-2018-12202
Description: Privilege escalation vulnerability in Platform Sample/ Silicon Reference firmware for 8th Generation Intel(R) Core™ Processor, 7th Generation Intel(R) Core™ Processor may allow privileged user to potentially leverage existing features via local access.
CVSS Base Score: 5.7 Medium
CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H

CVEID: CVE-2018-12203
Description: Denial of service vulnerability in Platform Sample/ Silicon Reference firmware for 8th Generation Intel® Core™ Processor, 7th Generation Intel® Core™ Processor may allow privileged user to potentially execute arbitrary code via local access.
CVSS Base Score: 2.3 Low
CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

CVEID: CVE-2018-12204
Description: Privilege escalation vulnerability in Platform Sample/ Silicon Reference firmware Intel(R) Server Board, Intel(R) Server System and Intel(R) Compute Module may allow privileged user to potentially execute arbitrary code via local access.
CVSS Base Score: 7.5 High
CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2018-12205
Description: Privilege escalation vulnerability in Platform Sample/ Silicon Reference firmware for 8th Generation Intel(R) Core™ Processor, 7th Generation Intel(R) Core™ Processor may allow unauthenticated user to potentially execute arbitrary code via physical access.
CVSS Base Score: 7.6 High
CVSS Vector: CVSS:3.0/AV/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products:

Firmware included with the following platform generations:
· 8th Generation Intel(R) Core™ Processor
· 7th Generation Intel(R) Core™ Processor
· Intel(R) Pentium(R) Silver J5005 Processor
· Intel(R) Pentium(R) Silver N5000 Processor
· Intel(R) Celeron(R) J4105 Processor
· Intel(R) Celeron(R) J4005 Processor
· Intel® Celeron(R) N4100 Processor
· Intel(R) Celeron® N4000 Processor
· Intel(R) Server Board
· Intel(R) Server System
· Intel(R) Compute Module
Recommendations:

Intel recommends that users of the affected Intel® products update to the latest version provided by the system manufacturer.

Acknowledgements:

Intel would like to thank Alexander Ermolov (CVE-2018-12204) for reporting these issues and working with us on coordinated disclosure.

The remaining issues were found internally by Intel employees.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are deployed.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]03/12/2019[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00191

Windows 10: Bios update for Intel identified potential security vulnerability in SMI Transfer monitor...

Bios update for Intel identified potential security vulnerability in SMI Transfer monitor...

Bios update for Intel identified potential security vulnerability in SMI Transfer monitor...

Bios update for Intel identified potential security vulnerability in SMI Transfer monitor...

Bios update for Intel identified potential security vulnerability in SMI Transfer monitor... - Similar Threads - Bios update Intel

Bios update for Intel identified potential security vulnerability in SMI Transfer monitor...

Potential security vulnerabilities in Intel USB 3.0 Creator Utility

Potential security vulnerabilities in Intel SGX SDK

Potential security vulnerabilities in Intel Matrix Storage Manager

Potential security vulnerabilities in Intel firmware

Intel Graphics Driver potential security vulnerabilities for Windows

Intel NUC Bios Updater Advisory for potential security vulnerability

Intel Server Board Firmware Advisory for potential vulnerability

CVE-2018-3612 - Intel NUC BIOS SW SMI Call-Out vulnerability