Vulnerability in Intel Xeon Processors Allows Limited Attacker Access
CVE-2018-3652

7.6HIGH

Key Information:

Vendor

Intel
Status
Intel Xeon Processor
Vendor
CVE Published:
10 July 2018

What is CVE-2018-3652?

The vulnerability in certain Intel Xeon processors pertains to inadequate restrictions on UEFI settings for the Direct Connect Interface (DCI). This flaw potentially allows an attacker with physical access to the system to exploit debug interfaces, which could reveal sensitive platform information. The affected processors include the 5th and 6th generation Intel Xeon E3 Family and other scalable models, underscoring the importance of ensuring tight physical security measures to mitigate potential exploitation risks.

Affected Version(s)

Intel Xeon Processor 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon Scalable processors, and Intel Xeon Processor D Family

References

https://security.netapp.com/advisory/ntap-20180802-0001/
x_refsource_CONFIRM
https://www.intel.com/content/www/us/en/security-center/a...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2018-3652 : Vulnerability in Intel Xeon Processors Allows Limited Attacker Access