Privilege escalation in Intel Trusted Execution Engine Firmware - CVE-2017-5707
Published: March 2, 2018
Vulnerability identifier: #VU10809
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5707
CWE-ID: CWE-120
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to gain elevated privileges.
The vulnerability exists due to multiple buffer overflows in kernel. A local attacker can execute arbitrary code with elevated privileges.
Affected software
Intel Trusted Execution Engine Firmware
SIMATIC IPC627D
SIMOTION P320-4S
SINUMERIK PCU50.5-P
WINXP
WIN7
SINUMERIK PCU50.5-C
SIMATIC ITP1000
SIMATIC IPC847D
SIMATIC IPC847C
SIMATIC IPC827D
SIMATIC IPC827C
SIMATIC IPC677D
SIMATIC IPC647D
SIMATIC IPC647C
SIMATIC Field-PG M3
SIMATIC IPC627C
SIMATIC IPC547G
SIMATIC IPC547E
SIMATIC IPC547D
SIMATIC IPC477E
SIMATIC IPC477D PRO
SIMATIC IPC477D
SIMATIC IPC427E
SIMATIC IPC427D
SIMATIC HMI IPC677C
SIMATIC Field-PG M5
SIMATIC Field-PG M4
SIMATIC IPC627D
SIMOTION P320-4S
SINUMERIK PCU50.5-P
WINXP
WIN7
SINUMERIK PCU50.5-C
SIMATIC ITP1000
SIMATIC IPC847D
SIMATIC IPC847C
SIMATIC IPC827D
SIMATIC IPC827C
SIMATIC IPC677D
SIMATIC IPC647D
SIMATIC IPC647C
SIMATIC Field-PG M3
SIMATIC IPC627C
SIMATIC IPC547G
SIMATIC IPC547E
SIMATIC IPC547D
SIMATIC IPC477E
SIMATIC IPC477D PRO
SIMATIC IPC477D
SIMATIC IPC427E
SIMATIC IPC427D
SIMATIC HMI IPC677C
SIMATIC Field-PG M5
SIMATIC Field-PG M4
How to mitigate CVE-2017-5707
Install update from vendor's website.