FKIE_CVE-2018-3612

Vulnerability from fkie_nvd - Published: 2018-05-10 22:29 - Updated: 2024-11-21 04:05
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate privileges to System Management Mode (SMM).
References
secure@intel.comhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00110.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00110.htmlVendor Advisory
Impacted products
Vendor Product Version
intel bios ayaplcel.86a
intel bios bnkbl357.86a
intel bios ccsklm5v.86a
intel bios ccsklm30.86a
intel bios dnkbli5v.86a
intel bios dnkbli7v.86a
intel bios dnkbli30.86a
intel bios fybyt10h.86a
intel bios gkaplcpx.86a
intel bios kyskli70.86a
intel bios mkkbli5v.86a
intel bios mkkbly35.86a
intel bios mybdwi5v.86a
intel bios mybdwi30.86a
intel bios rybdwi35.86a
intel bios syskli35.86a
intel bios tybyt10h.86a
intel ayaplcel.86a -
intel bnkbl357.86a -
intel ccsklm30.86a -
intel ccsklm5v.86a -
intel dnkbli30.86a -
intel dnkbli5v.86a -
intel dnkbli7v.86a -
intel fybyt10h.86a -
intel gkaplcpx.86a -
intel kyskli70.86a -
intel mkkbli5v.86a -
intel mkkbly35.86a -
intel mybdwi30.86a -
intel mybdwi5v.86a -
intel rybdwi35.86a -
intel syskli35.86a -
intel tybyt10h.86a -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:intel:bios:ayaplcel.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1896E1D-D6AB-4B50-9FAB-D3447D2999D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:bnkbl357.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "37453985-F8E6-4ECF-91D6-202451DADA92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:ccsklm5v.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "E034F066-DC2A-4D3E-98B7-FDA72D9D9525",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:ccsklm30.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA083126-8215-45A0-93E0-89B24F1F64B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:dnkbli5v.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F6E96F7-D04D-4374-8492-BCD040A3C6A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:dnkbli7v.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "A288FDDC-ED63-47EC-81C6-5B0EB2DB7C45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:dnkbli30.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "45A0C3B2-B87D-44E9-A2B5-FC8091000F20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:fybyt10h.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AE305F6-9721-465A-BEA3-02A586FDD988",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:gkaplcpx.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "79C62F39-AA5A-4005-B52D-C1E71ABF4B4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:kyskli70.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "D59DF70A-4D07-43AC-92FA-3C0C572A8FBB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:mkkbli5v.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3603E56-B75F-4DF9-BF26-1F24F798C819",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:mkkbly35.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "9262CEEE-DA83-4FF2-82DF-56B5017FCBED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:mybdwi5v.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "775E8F59-584B-469A-86B2-4624E9F24398",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:mybdwi30.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "293D2DD9-388E-49F0-A250-B711AD95A5A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:rybdwi35.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC3D0C8A-D816-4578-9ECC-341F92F5E83E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:syskli35.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "70A2E146-6025-417C-B9CF-8C50D33CB2DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bios:tybyt10h.86a:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEE47419-DD81-4EC4-B242-750028B503CA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:intel:ayaplcel.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "76ACD951-E428-46F3-BE3F-62DCDF5C429A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:bnkbl357.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5071F003-8722-4565-896C-05DE1B673DDD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:ccsklm30.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FCE7D8D2-F77C-42B9-B6DC-EA6AFF96F3D3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:ccsklm5v.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8BFD583-73D3-4502-8F57-346FFD82CBC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:dnkbli30.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D9D0EFB-B4CC-445C-8AFC-8DC742FD0791",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:dnkbli5v.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "633957F3-3057-4403-B114-8C1081CD8297",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:dnkbli7v.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7CC7C59F-AAE9-4046-9AAB-C7313C395161",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:fybyt10h.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "13A262A3-4129-4566-AC5D-D37ED8524341",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:gkaplcpx.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7193D25D-CEB0-469B-941D-9CB71308A48A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:kyskli70.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2051D75E-C61C-47FB-98E3-43458F7C60C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:mkkbli5v.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DFBBD7A9-18D5-4325-AC7D-77B582A8BF7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:mkkbly35.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EB25DE7-5731-43C5-BEDC-84E6C3BA44E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:mybdwi30.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D821496B-7B10-46D5-8175-86D5B25855E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:mybdwi5v.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "371F831A-9685-460A-83CD-EB8F7A098C50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:rybdwi35.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "953A2F51-AD64-4474-9367-CB0D05C7CEF9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:syskli35.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "238F86AD-4B21-42F0-BCC7-1E4A6D0E4AEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:intel:tybyt10h.86a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "79E2E85E-12CA-4BAC-AAE9-C1D3A2C34774",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate privileges to System Management Mode (SMM)."
    },
    {
      "lang": "es",
      "value": "Los kits Intel NUC con validaci\u00f3n de entradas insuficiente en el firmware del sistema  pueden permitir que un atacante local eleve privilegios a SMM (System Management Mode)."
    }
  ],
  "id": "CVE-2018-3612",
  "lastModified": "2024-11-21T04:05:46.240",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-05-10T22:29:00.307",
  "references": [
    {
      "source": "secure@intel.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00110.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00110.html"
    }
  ],
  "sourceIdentifier": "secure@intel.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.