Vulnerability CVE-2017-5703


Published: 2018-04-03

Description:
Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.

Type:

CWE-269

(Improper Privilege Management)

Vendor: Intel
Product: Xeon e3-1245 v5 
Product: Core i7-5775r 
Product: Xeon e7-4809 v3 
Product: Core i7-7700t 
Product: Xeon e7-8891 v2 
Product: Xeon 4114t 
Product: Xeon 6150 
Product: Atom c2508 
Product: Xeon d-1541 
Product: Atom x5-z8350 
Product: Xeon e3-1230 v6 
Product: Core i7-5650u 
Product: Xeon e7-2850 v2 
Product: Core i7-7600u 
Product: Xeon e7-8880l v2 
Product: Xeon 4108 
Product: Xeon 6142m 
Product: Atom c2308 
Product: Xeon d-1531 
Product: Atom x5-e3930 
Product: Xeon e3-1220 v5 
Product: Celeron n3520 
Product: Xeon e3-1565l v5 
Product: Core i7-6920hq 
Product: Xeon e7-8870 v3 
Product: Pentium n3700 
Product: Xeon 6138t 
Product: Xeon d-1521 
Product: Atom c3850 
Product: Xeon d-2166nt 
Product: Celeron n2830 
Product: Xeon e3-1515m v5 
Product: Core i7-6820eq 
Product: Xeon e7-8860 v3 
Product: Core i7-8809g 
Product: Xeon 6134 
Product: Xeon 8180 
Product: Atom c3708 
Product: Xeon d-2143it 
Product: Celeron n2807 
Product: Xeon e3-1501m v6 
Product: Core i7-6700k 
Product: Xeon e7-4870 v2 
Product: Core i7-8700t 
Product: Xeon phi 7250f 
Product: Xeon 6128 
Product: Xeon 8170 
Product: Atom c3308 
Product: Xeon d-1571 
Product: Celeron j3160 
Product: Xeon e3-1275 v6 
Product: Core i7-6600u 
Product: Xeon e7-4830 v4 
Product: Core i7-8559u 
Product: Xeon phi 7210 
Product: Xeon 5120t 
Product: Xeon 8160f 
Product: Atom c2718 
Product: Xeon e3-1260l v5 
Product: Core i7-5850hq 
Product: Xeon e7-4820 v2 
Product: Core i7-7820hk 
Product: Xeon e7-8891 v4 
Product: Xeon 4116t 
Product: Xeon 6154 
Product: Atom c2518 
Product: Xeon d-1548 
Product: Atom x5-z8550 
Product: Xeon e3-1240 v5 
Product: Core i7-5700hq 
Product: Xeon e7-2880 v2 
Product: Core i7-7700 
Product: Xeon e7-8890 v2 
Product: Xeon 4110 
Product: Xeon 6146 
Product: Atom c2338 
Product: Xeon d-1537 
Product: Atom x5-e8000 
Product: Xeon e3-1225 v5 
Product: Core i7-5550u 
Product: Xeon e3-1578l v5 
Product: Core i7-7500u 
Product: Xeon e7-8880 v2 
Product: Pentium n4200 
Product: Xeon 6140m 
Product: Xeon d-1527 
Product: Atom c3950 
Product: Xeon d-2177nt 
Product: Celeron n2920 
Product: Xeon e3-1535m v6 
Product: Core i7-6820hq 
Product: Xeon e7-8867 v3 
Product: Pentium j3710 
Product: Xeon 6136 
Product: Xeon d-1513n 
Product: Atom c3758 
Product: Xeon d-2146nt 
Product: Celeron n2810 
Product: Xeon e3-1505l v6 
Product: Core i7-6700te 

CVSS2 => (AV:L/AC:L/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.6/10
4.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial

 References:
http://www.securitytracker.com/id/1040626
https://security.netapp.com/advisory/ntap-20180924-0004/
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00087&languageid=en-fr
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03867en_us

Related CVE
CVE-2019-11184
A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial information disclosure via adjacent access.
CVE-2019-11166
Improper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1.0731 may allow an authenticated user to potentially enable escalation of privilege via local attack.
CVE-2019-11163
Insufficient access control in a hardware abstraction driver for Intel(R) Processor Identification Utility for Windows before version 6.1.0731 may allow an authenticated user to potentially enable escalation of privilege, denial of service or informa...
CVE-2019-11148
Improper permissions in the installer for Intel(R) Remote Displays SDK before version 2.0.1 R2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2019-11143
Improper permissions in the software installer for Intel(R) Authenticate before 3.8 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2019-11140
Insufficient session validation in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-0173
Authentication bypass in the web console for Intel(R) Raid Web Console 2 all versions may allow an unauthenticated attacker to potentially enable disclosure of information via network access.
CVE-2019-11129
Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.

Copyright 2019, cxsecurity.com

 

Back to Top