Security restrictions bypass in Supermicro X10 UP-series Denlow motherboards

1) Security restrictions bypass

EUVDB-ID: #VU51219

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in BIOS firmware for X10 UP-series (H3 Single Socket “Denlow”) motherboard. A local user can plant malware into motherboard firmware and establish permanent persistence on the system, even if OS is reinstalled.

Note, the vulnerability is being actively exploited in the wild by the TrickBoot malware.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

X10SLH-F: All versions

X10SLL-F: All versions

X10SLM-F: All versions

X10SLL+-F: All versions

X10SLM+-F: All versions

X10SLM+-LN4F: All versions

X10SLA-F: All versions

X10SL7-F: All versions

X10SLL-S/-SF: All versions

CPE2.3

• cpe:2.3:h:supermicro:x10slh-f:*:*:*:*:*:*:*:
• cpe:2.3:h:supermicro:x10sll-f:*:*:*:*:*:*:*:
• cpe:2.3:h:supermicro:x10slm-f:*:*:*:*:*:*:*:
• cpe:2.3:h:supermicro:x10sll_-f:*:*:*:*:*:*:*:
• cpe:2.3:h:supermicro:x10slm_-f:*:*:*:*:*:*:*:
• cpe:2.3:h:supermicro:x10slm_-ln4f:*:*:*:*:*:*:*:
• cpe:2.3:h:supermicro:x10sla-f:*:*:*:*:*:*:*:
• cpe:2.3:h:supermicro:x10sl7-f:*:*:*:*:*:*:*:
• cpe:2.3:h:supermicro:x10sll-s_-sf:*:*:*:*:*:*:*:

External links

http://www.supermicro.com/en/support/security/Trickbot

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.