Intel has released recommendations to address vulnerabilities in the firmware of some of its products following the identification of vulnerabilities by external security researchers.
The Department of Homeland Security’s US-CERT issued a security advisory regarding the identified vulnerabilities.
The affected products include: Management Engine, Server Platform Services, and Trusted Execution Engine. An attacker could exploit some of these vulnerabilities to take control of an affected system.
The company said it has identified several security vulnerabilities that could potentially place impacted platforms at risk. Systems using ME Firmware versions 11.0/11.5/11.6/11.7/11.10/11.20, SPS Firmware version 4.0, and TXE version 3.0 are impacted.
Based on the items identified through the comprehensive security review, an attacker could gain unauthorized access to platform, Intel ME feature, and 3rd party secrets protected by the Intel Management Engine (ME), Intel Server Platform Service (SPS), or Intel Trusted Execution Engine (TXE).
This includes scenarios where a successful attacker could:
- Impersonate the ME/SPS/TXE, thereby impacting local security feature attestation validity.
- Load and execute arbitrary code outside the visibility of the user and operating system.
- Cause a system crash or system instability.
For more information, refer to this Intel Support article
Intel has released a downloadable detection tool located at http://www.intel.com/sa-00086-support, which will analyze your system for the vulnerabilities identified in this security advisory.
The company highly recommends checking with your system OEM for updated firmware. Links to system manufacturer pages concerning this issue can be found at http://www.intel.com/sa-00086-support
Intel highly recommends that all customers install the updated firmware and Intel Capability License Service on impacted platforms.
