Intel CSME return return value

Summaryinfo

A vulnerability classified as problematic was found in Intel CSME. This affects an unknown function. Such manipulation of the argument return leads to return value. This vulnerability is listed as CVE-2023-40067. The attack can be executed directly on the physical device. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Intel CSME (version unknown) and classified as problematic. Affected by this issue is an unknown function. The manipulation of the argument return with an unknown input leads to a return value vulnerability. Using CWE to declare the problem leads to CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Unchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

The advisory is shared for download at intel.com. This vulnerability is handled as CVE-2023-40067 since 10/05/2023. The exploitation is known to be difficult. The attack needs to be approached locally. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at intel.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Intel

Name

• CSME

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion