CVE-2018-3612

Published: May 10, 2018Modified: Nov 21, 2024

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate privileges to System Management Mode (SMM).

Affected (34)

Products: Intel: Bios, Ayaplcel.86a, Bnkbl357.86a, Ccsklm30.86a, Ccsklm5v.86a, Dnkbli30.86a, Dnkbli5v.86a, Dnkbli7v.86a, Fybyt10h.86a, Gkaplcpx.86a, Kyskli70.86a, Mkkbli5v.86a, Mkkbly35.86a, Mybdwi30.86a, Mybdwi5v.86a, Rybdwi35.86a, Syskli35.86a, Tybyt10h.86a

18 products

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Intel Bios	Version ayaplcel.86a
Intel Bios	Version bnkbl357.86a
Intel Bios	Version ccsklm30.86a
Intel Bios	Version ccsklm5v.86a
Intel Bios	Version dnkbli30.86a
Intel Bios	Version dnkbli5v.86a
Intel Bios	Version dnkbli7v.86a
Intel Bios	Version fybyt10h.86a
Intel Bios	Version gkaplcpx.86a
Intel Bios	Version kyskli70.86a
Intel Bios	Version mkkbli5v.86a
Intel Bios	Version mkkbly35.86a
Intel Bios	Version mybdwi30.86a
Intel Bios	Version mybdwi5v.86a
Intel Bios	Version rybdwi35.86a
Intel Bios	Version syskli35.86a
Intel Bios	Version tybyt10h.86a

Configuration B

17 vulnerable

Vulnerable Software	Affected Versions
Intel Ayaplcel.86a	All versions
Intel Bnkbl357.86a	All versions
Intel Ccsklm30.86a	All versions
Intel Ccsklm5v.86a	All versions
Intel Dnkbli30.86a	All versions
Intel Dnkbli5v.86a	All versions
Intel Dnkbli7v.86a	All versions
Intel Fybyt10h.86a	All versions
Intel Gkaplcpx.86a	All versions
Intel Kyskli70.86a	All versions
Intel Mkkbli5v.86a	All versions
Intel Mkkbly35.86a	All versions
Intel Mybdwi30.86a	All versions
Intel Mybdwi5v.86a	All versions
Intel Rybdwi35.86a	All versions
Intel Syskli35.86a	All versions
Intel Tybyt10h.86a	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00110.html

Source: secure@intel.com

Vendor Advisory

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00110.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.