Vulnerability CVE-2011-5174


Published: 2012-09-15

Description:
Buffer overflow in Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) in Intel Q67 Express, C202, C204, C206 Chipsets, and Mobile Intel QM67, and QS67 Chipset before 2nd_gen_i5_i7_SINIT_51.BIN Express; Intel Q57, 3450 Chipsets and Mobile Intel QM57 and QS57 Express Chipset before i5_i7_DUAL_SINIT_51.BIN and i7_QUAD_SINIT_51.BIN; Mobile Intel GM45, GS45, and PM45 Express Chipset before GM45_GS45_PM45_SINIT_51.BIN; Intel Q35 Express Chipsets before Q35_SINIT_51.BIN; and Intel 5520, 5500, X58, and 7500 Chipsets before SINIT ACM 1.1 allows local users to bypass the Trusted Execution Technology protection mechanism and perform other unspecified SINIT ACM functions via unspecified vectors.

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

Vendor: Intel
Product: Mobile intel qs67 chipset 
Version: _express-;
Product: Sinit authenticated code module 
Version:
q35_sinit_18.bin
i7_quad_sinit_20.bin
i5_i7_dual_sinit_18.bin
gm45_gs45_pm45_sinit_21.bin
2nd_gen_i5_i7_sinit_1.9.bin
1.0
Product: C204 chipset 
Product: 3450 chipset 
Product: Q67 express chipset 
Product: Mobile intel qs57 chipset 
Product: Mobile intel gm45 chipset 
Product: 5520 chipset 
Product: Mobile intel pm45 express chipset 
Product: C202 chipset 
Product: Q57 chipset 
Product: Mobile intel qm67 chipset 
Product: C206 chipset 
Product: 5500 chipset 
Product: X58 chipset 
Product: Mobile intel qs57 express chipset 
Product: Mobile intel gs45 chipset 
Product: 7500 chipset 
Product: Q35 express chipset 
Product: Mobile intel qm57 chipset 

CVSS2 => (AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.2/10
10/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00030&languageid=en-fr
http://theinvisiblethings.blogspot.com/2011/12/exploring-new-lands-on-intel-cpus-sinit.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/71625

Related CVE
CVE-2019-11129
Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-11128
Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-11127
Buffer overflow in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-11126
Pointer corruption in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-11125
Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-11124
Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-11123
Insufficient session validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-11119
Insufficient session validation in the service API for Intel(R) RWC3 version 4.186 and before may allow an unauthenticated user to potentially enable escalation of privilege via network access.

Copyright 2019, cxsecurity.com

 

Back to Top