Vulnerability Details : CVE-2017-5707
Multiple buffer overflows in kernel in Intel Trusted Execution Engine Firmware 3.0 allow attacker with local access to the system to execute arbitrary code.
Vulnerability category: OverflowExecute code
Products affected by CVE-2017-5707
- cpe:2.3:o:intel:trusted_execution_engine_firmware:3.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5707
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 33 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5707
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2017-5707
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5707
-
http://www.securityfocus.com/bid/101919
Intel Trusted Execution Engine CVE-2017-5707 Multiple Local Buffer Overflow VulnerabilitiesThird Party Advisory;VDB Entry
-
https://security.netapp.com/advisory/ntap-20171120-0001/
Intel SA-00086 Management Engine Vulnerabilities in NetApp Products | NetApp Product SecurityIssue Tracking;Third Party Advisory
-
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr
INTEL-SA-00086Issue Tracking;Vendor Advisory
-
https://www.synology.com/support/security/Synology_SA_17_73
Synology Inc.
-
https://www.asus.com/News/wzeltG5CjYaIwGJ0
ASUS Motherboards Statement on Intel ME/TXE Advisory
-
https://twitter.com/PTsecurity_UK/status/938447926128291842
PT Security on Twitter: "Update released by Intel does not eliminate possibility of attack: exploitation of these vulnerabilities: having access to ME-region attacker can write vulnerable version of #
-
https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf
Jump to