Intel MinnowBoard 3 up to 0.64 UEFI API input validation

Summaryinfo

A vulnerability was found in Intel MinnowBoard 3 up to 0.64 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component UEFI API Handler. The manipulation results in input validation. This vulnerability is known as CVE-2017-5699. Attacking locally is a requirement. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Intel MinnowBoard 3 up to 0.64 (Forum Software). It has been classified as problematic. Affected is an unknown code of the component UEFI API Handler. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on availability. CVE summarizes:

Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs.

The bug was discovered 02/01/2017. The weakness was published 01/18/2018 (Website). The advisory is shared for download at edk2-docs.gitbooks.io. This vulnerability is traded as CVE-2017-5699 since 02/01/2017. The attack needs to be approached locally. A authentication is needed for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 350 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 0.65 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Forum Software

Vendor

• Intel

Name

• MinnowBoard 3

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51
• 0.52
• 0.53
• 0.54
• 0.55
• 0.56
• 0.57
• 0.58
• 0.59
• 0.60
• 0.61
• 0.62
• 0.63
• 0.64

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion