The latest security information on Intel® products.

Intel® Baseboard Management Controller (BMC) firmware Advisory

Intel ID: INTEL-SA-00149
Advisory Category: Firmware
Impact of vulnerability: Escalation of Privilege, Denial of Service
Severity rating: HIGH
Original release: 09/11/2018
Last revised: 09/11/2018

Summary:

A potential security vulnerability in Intel® Baseboard Management Controller (BMC) firmware may allow escalation of privilege or denial of service. Intel is releasing updates for Intel® Baseboard Management Controller (BMC) firmware to mitigate this potential vulnerability.

Vulnerability Details

CVEID: CVE-2018-12171

Description: Privilege escalation in Intel® Baseboard Management Controller (BMC) firmware before version 1.43.91f76955 may allow an unprivileged user to potentially execute arbitrary code or perform denial of service over the network.

CVSS Base Score: 8.3 High

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products:

Product Family

Product Name

MM#

Intel® Server Board S2600BP

BBS2600BPB

948899

BBS2600BPQ

948900

BBS2600BPS

952609

HNS2600BPB

976668

HNS2600BPQ

976669

HNS2600BPS

976670

HNS2600BPB24

976671

HNS2600BPQ24

976675

HNS2600BPS24

976676

HNS2600BPBLC24

977207

HNS2600BPBLC

961401

Intel® Server Board S2600WF

S2600WFO

952644

S2600WFQ

952645

S2600WFT

952641

R1304WF0YS

952626

R1304WFTYS

952625

R1208WFTYS

952627

R2308WFTZS

952631

R2208WF0ZS

952629

R2208WFTZS

952628

R2208WFQZS

952637

R2312WF0NP

955876

R2312WFTZS

952632

R2312WFQZS

955877

R2224WFQZS

955875

R2224WFTZS

952633

Intel® Server Board S2600ST

S2600STB

957180

S2600STQ

957318

BBS2600STB

959820

BBS2600STQ

959727

Recommendations:

Intel recommends that users of affected products upgrade to the latest platform firmware package.

For systems based on the Intel® Server Board S2600BP family, the platform firmware package is available here, and is "00.01.0013":
·         SUP (EFI Shell) https://downloadcenter.intel.com/download/27633
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27637

For systems based on the Intel® Server Board S2600WF family, the platform firmware package is available here, and is "00.01.0013":
·         SUP (EFI Shell) https://downloadcenter.intel.com/download/27632
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27642

For systems based on the Intel® Server Board S2600ST family, the platform firmware package is available here, and is "00.01.0013":
·         SUP (EFI Shell) https://downloadcenter.intel.com/download/27672
·         Intel® OFU (OS-level update) https://downloadcenter.intel.com/download/27643

Acknowledgements:

Intel would like to thank Lenovo for reporting this issue and working with us on coordinated disclosure.

Revision History

Revision Date Description
1.0 09/11/2018 Initial Release

Legal Notices and Disclaimers

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel, processors, chipsets, and desktop boards may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No computer system can be absolutely secure. Check with your system manufacturer or retailer or learn more at https://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

Intel and the Intel logo are trademarks of Intel Corporation in the United States and other countries.

*Other names and brands may be claimed as the property of others.
Copyright © Intel Corporation 2018

Report a Vulnerability

If you have information about a security issue or vulnerability with an Intel branded product or technology, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

  • The products and versions affected
  • Detailed description of the vulnerability
  • Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

For issues related to Intel managed open source projects, please visit http://www.01.org/security

Need product support?

The secure@intel.com e-mail address should only be used for reporting security issues.

If you...

  • Have questions about the security features of an Intel product
  • Require technical support
  • Want product updates or patches


Please visit Support & Downloads.