Intel Server Platform Service 4.0.x.x Kernel access control

Summaryinfo

A vulnerability described as critical has been identified in Intel Server Platform Service 4.0.x.x. This vulnerability affects unknown code of the component Kernel. Such manipulation leads to access control. This vulnerability is uniquely identified as CVE-2017-5709. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Intel Server Platform Service 4.0.x.x. It has been rated as critical. Affected by this issue is an unknown code block of the component Kernel. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, and integrity. CVE summarizes:

Multiple privilege escalations in kernel in Intel Server Platform Services Firmware 4.0 allows unauthorized process to access privileged content via unspecified vector.

The bug was discovered 11/20/2017. The weakness was disclosed 11/20/2017 as INTEL-SA-00086 as confirmed security advisory (Website). The advisory is shared for download at security-center.intel.com. This vulnerability is handled as CVE-2017-5709 since 02/01/2017. The exploitation is known to be difficult. The attack needs to be approached locally. The requirement for exploitation is a simple authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068. The advisory points out:

In response to issues identified by external researchers, Intel has performed an in-depth comprehensive security review of our Intel® Management Engine (ME), Intel® Server Platform Services (SPS), and Intel® Trusted Execution Engine (TXE) with the objective of enhancing firmware resilience. As a result, Intel has identified security vulnerabilities that could potentially place impacted platforms at risk.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at SecurityFocus (BID 101906†) and SecurityTracker (ID 1039955†). wired.com is providing further details. The entries VDB-109767, VDB-109768, VDB-109769 and VDB-109770 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Affected

• Intel Server Platform Service 4.0.x.x
• HPE ProLiant Server

Productinfo

Vendor

• Intel

Name

• Server Platform Service

Version

• 4.0.x.x

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion