Intel is warning of a high-severity vulnerability existing in its software that identifies the specification of Intel processors in Windows systems. The flaw could have an array of malicious impacts on affected systems, such as opening systems up to information disclosure or denial of service attacks.
The update is part of an August round of patches issued by the chip maker, addressing three high-severity flaws and five medium-severity bugs.
“Intel has released security updates to address vulnerabilities in multiple products,” according Intel’s Tuesday advisory. “An attacker could exploit some of these vulnerabilities to gain an escalation of privileges on a previously infected machine.”
One of the more serious vulnerabilities exist in the Intel Processor Identification Utility for Windows, free software that users can install on their Windows machines to identify the actual specification of their processors.
The flaw (CVE-2019-11163) has a score of 8.2 out of 10 on the CVSS scale, making it high severity. It stems from insufficient access control in a hardware abstraction driver for the software, versions earlier than 6.1.0731.
This glitch “may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access” according to Intel. Users are urged to update to version 6.1.0731.
Other High-Severity Flaws
Intel stomped out another high-severity vulnerability in its Computing Improvement Program, which is program that Intel users can opt into that uses information about participants’ computer performance to make product improvement and detect issues.
However, the program contains a flaw (CVE-2019-11162) in the hardware abstraction of the SEMA driver that could allow escalation of privilege, denial of service or information disclosure.
Intel NUC
“Insufficient access control in hardware abstraction in SEMA driver for Intel Computing Improvement Program before version 2.4.0.04733 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access,” said Intel.
A final high-severity flaw was discovered in the system firmware of the Intel NUC (short for Next Unit of Computing), a mini-PC kit used for gaming, digital signage and more.
The flaw (CVE-2019-11140) with a CVSS score of 7.5 out of 10, stems from insufficient session validation in system firmware of the NUC. This could enable a user to potentially enable escalation of privilege, denial of service and information disclosure. An exploit of the flaw would come with drawbacks – a bad actor would need existing privileges and local access to the victim system.
Vulnerabilities continue to crop up in the NUC – in April Intel slapped a high-severity NUC vulnerability (CVE-2019-0163) that could enable escalation of privilege, denial of service, and information disclosure for impacted systems; while in June, Intel patched seven high-severity vulnerabilities in the system firmware of its Intel NUC.
Intel’s latest swath of patches also come on the heels of a new type of side-channel attack revealed last week impacting millions of newer Intel microprocessors manufactured after 2012. The attack, SWAPGS, is similar to existing side-channel attacks such as Spectre and Meltdown and similarly could allow a hacker to gain access to sensitive data such as passwords and encryption keys on consumer and enterprise PCs.
