Intel has patched seven high-severity vulnerabilities in the system firmware of its Intel NUC (short for Next Unit of Computing), a mini-PC kit used for gaming, digital signage and more.
Overall, the chip-maker patched 25 vulnerabilities across various platforms this week – including eight high-severity flaws, 13 medium-severity flaws and four low-severity glitches. The majority of the high-severity flaws resided in the system firmware of Intel’s NUC mini PC kit, which offers processing, memory and storage capabilities for applications like digital signage, media centers and kiosks.
“Potential security vulnerabilities in system firmware for Intel NUC may allow escalation of privilege, denial of service and/or information disclosure,” according to Intel’s Tuesday advisory. “Intel is releasing firmware updates to mitigate these potential vulnerabilities.”
The most severe of these flaws (CVE-2019-11127), a buffer overflow vulnerability in the NUC kit, has a CVSS score of 8.2 out of 10. Another high-severity flaw with a CVSS score of 8.2 out of 10 (CVE-2019-11128) stems from insufficient input validation in system firmware for Intel’s NUC Kit.
Both flaws could also enable a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
The remainder of high-severity flaws in Intel NUC firmware (all with a CVSS score of 7.5 out of 10) include out of bound read/write flaws (CVE-2019-11129 and CVE-2019-11124), a pointer corruption glitch (CVE-2019-11126), and insufficient input validation vulnerabilities (CVE-2019-11125 and CVE-2019-11123).
Impacted are a variety of NUC Kit and Intel Compute cards: for the full list of affected products – and subsequent update firmware versions – click here. Intel credited security researchers Alexander Ermolov, Ruslan Zakirov and Malyutin Maksim for reporting the issues.
Beyond the NUC, Intel also patched a high-severity flaw in its RAID Web Console 3 (RWC3) for Windows (versions 4.186 and earlier).The RAID Web Console 3 is a web-based application that monitors, maintains and troubleshoots Intel’s RAID controllers, which are designed for intensive workloads.
This vulnerability (CVE-2019-11119) is high-severity, with a 8.9 out of 10 score on the CVSS scale. The flaw, found internally by an Intel employee, stems from insufficient session validation in the service API of the web console. It may allow an unauthenticated user to potentially enable escalation of privilege via network access, according to Intel.
“Intel recommends that users of Intel RAID Web Console 3 for Windows update to 7.009.011.000 or later,” according to Intel’s advisory.
Several low and medium-severity flaws were also discovered in several Intel products, including the Intel Turbo Boost Max Technology 3, Intel Omni-Patch Fabric Manager GUI, Intel SGX for Linux and Intel ProSet/Wireless Wi-Fi software.
Vulnerabilities that keep cropping up in the chipmaker’s NUC products. In May, Intel fixed high-severity flaw CVE-2019-11094, which could also enable enable escalation of privilege, denial of service and/or information disclosure via local access. And in April, Intel released security updates addressing two high-severity vulnerabilities in its Intel Media Software Development Kit (SDK) and Intel NUC mini PC.
Ransomware is on the rise: Don’t miss our free Threatpost webinar on the ransomware threat landscape, June 19 at 2 p.m. ET. Join Threatpost and a panel of experts as they discuss how to manage the risk associated with this unique attack type, with exclusive insights into new developments on the ransomware front and how to stay ahead of the attackers.
