Intel Firmware vulnerability INTEL-SA-00086 |
Advisory note: Intel Q3’17 ME 11.x, SPS 4.0, and TXE 3.0 Security Review Cumulative Update |
| Reference: Intel security vulnerabilities (INTEL-SA-00086) |
| In response to issues identified by external researchers, Intel has performed an in-depth comprehensive security review of its Intel® Management Engine (ME), Intel® Trusted Execution Engine (TXE), and Intel® Server Platform Services (SPS) with the objective of enhancing firmware resilience. |
| As a result, Intel has identified several security vulnerabilities that could potentially place impacted platforms at risk. Systems using ME Firmware versions 11.0/11.5/11.6/11.7/11.10/11.20, SPS Firmware version 4.0, and TXE version 3.0 are impacted. Fujitsu and Intel highly recommend that all customers install updated firmware and Intel® Capability License Service on impacted platforms. |
For more detailed information please refer to the Intel web site:
https://security-center.intel.com/ |
| Affected Fujitsu products: |
| A number of Fujitsu products are affected by the vulnerabilities identified in above mentioned Intel firmware versions. |
An overview can be found here:
List of affected systems. |
| Fujitsu strongly advises that all customers install updated firmware / BIOS and Intel® Capability License Service (iCLS) Client Software on impacted platforms. The update process and remediation steps are outlined below. |
| CVE Reference: |
| Intel® Manageability Engine Firmware 11.0.x.x/11.5.x.x/11.6.x.x/11.7.x.x/11.10.x.x/11.20.x.x |
| CVE Number | CVSS |
| CVE-2017-5705 | CVSS 8.2 |
| CVE-2017-5708 | CVSS 7.5 |
| CVE-2017-5711 | CVSS 6.7 |
| CVE-2017-5712 | CVSS 7.2 |
|
| Intel® Manageability Engine Firmware 8.x/9.x/10.x* |
| CVE Number | CVSS |
| CVE-2017-5711* | CVSS 6.7 |
| CVE-2017-5712* | CVSS 7.2 |
*The two CVEs above were also resolved in earlier generations of Intel ME where certain subsystems share the same code base.
|
| Intel® Server Platform Service 4.0.x.x |
| CVE Number | CVSS |
| CVE-2017-5706 | CVSS 8.2 |
| CVE-2017-5709 | CVSS 7.5 |
|
| Intel® Trusted Execution Engine 3.0.x.x |
| CVE Number | CVSS |
| CVE-2017-5707 | CVSS 8.2 |
| CVE-2017-5710 | CVSS 7.5 |
|
| Description: |
| Based on the items identified through a comprehensive security review, an attacker could gain unauthorized access to platforms, Intel® ME features, and third-party data protected by the Intel® Management Engine (ME), Intel® Server Platform Service (SPS), or Intel® Trusted Execution Engine (TXE). |
This includes scenarios where a successful attacker could:
- Impersonate the ME/SPS/TXE, thereby impacting the validity of local security features.
- Load and execute arbitrary code outside the visibility of the user and operating system.
- Cause a system crash or system instability.
|
| Attention: |
- Due to the potential exposure of platform keys, Intel will re-provision new platform keys on impacted systems.
- Revocation of existing platform keys on impacted systems is being targeted for the first half of 2018 in a coordinated effort with impacted third-party content & service providers.
- Re-provisioning of platform keys on impacted systems should occur prior to the revocation to avoid potential interruptions in third-party services.
|
| Recommended steps for remediation: |
| Step 1: Determine if you have an affected system with Intel® Management Engine (ME), Intel® Server Platform Service (SPS), or Intel® Trusted Execution Engine (TXE). |
Consult the list of affected Fujitsu systems. This list is updated regularly.
Before proceeding, please check the expected availability of the firmware-/BIOS update package. |
| Step 2: Download and install the firmware-/BIOS update package (Fujitsu recommends using the BIOS update application in Windows, if available). |
To install and download the BIOS or firmware update package, please go to Fujitsu support page and proceed with the following actions:
- Select “Browse for Product”.
- Select “product line”.
- Select “product group” and “product family”.
- Select “operating system”.
- Download and install the latest firmware- / BIOS update package from the “Driver - AMT“ (LIFEBOOK models only) or “BIOS“ section
|
| Step 3: (not applicable to PRIMERGY systems): Download the Intel Management Engine Driver package |
To re-provision the security platform keys, the latest version (Version 1.47.715.0. or higher) of the Intel® Capability License Service (iCLS) Client software is required. The iCLS client software is a part of the Intel® MEI driver software installer package. The Intel Management Engine Driver version 11.7.0.1043 or higher must be installed to ensure the correct iCLS client software version.
To install and download the Intel Management Engine Driver package, please go to the Fujitsu support page and proceed with the following actions:
- Select “Browse for Product”.
- Select “product line”.
- Select “product group” and “product family”.
- Select “operating system”.
- Download and install the latest Intel Management Engine Driver package from the “Driver - AMT“ section
|
| Should you require any further information at this stage, please contact: G02D-psirt@ts.fujitsu.com. |
