High severity · published Jul 10, 2018
CVE-2018-3652
Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon Scalable processors, and Intel Xeon…
7.6
CVSS
0.4%
EPSS
No
On KEV
Description
Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon Scalable processors, and Intel Xeon Processor D Family allows a limited physical presence attacker to potentially access platform secrets via debug interfaces.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Atom C · Intel
c2308; c2316; c2338; c2350; c2358; c2508; +27 more · source: NVD
XE
Xeon · Intel
d-1513n; d-1518; d-1520; d-1521; d-1523n; d-1527; +29 more · source: NVD
XB
Xeon Bronze 3104 · Intel
All versions, or not specified · source: NVD
XB
Xeon Bronze 3106 · Intel
All versions, or not specified · source: NVD
XE
Xeon E3 · Intel
1505m_v6; 1515m_v5; 1535m_v5; 1535m_v6; 1545m_v5; 1558l_v5; +5 more · source: NVD
XE
Xeon E3 1220 V5 · Intel
All versions, or not specified · source: NVD
XE
Xeon E3 1220 V6 · Intel
All versions, or not specified · source: NVD
XE
Xeon E3 1225 V5 · Intel
All versions, or not specified · source: NVD
XE
Xeon E3 1225 V6 · Intel
All versions, or not specified · source: NVD
XE
Xeon E3 1230 V5 · Intel
All versions, or not specified · source: NVD
XE
Xeon E3 1230 V6 · Intel
All versions, or not specified · source: NVD
XE
Xeon E3 1235l V5 · Intel
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3652
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3652
Third Party Advisory
https://security.netapp.com/advisory/ntap-20180802-0001/
Mitigation
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00127.html
More from Atom C
5.6
CVE-2018-3693
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a…
5.6
CVE-2018-3640
Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an…
5.6
CVE-2018-9056
Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user access via a side-channel attack on…
5.6
CVE-2017-5754
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access…
5.6
CVE-2017-5753
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a…