Vulnerability-Lookup

CNVD-2017-26598

Vulnerability from cnvd - Published: 2017-09-13

Title

Intel® Software Guard Extensions权限提升漏洞

Description

Intel® Software Guard Extensions是应用开发者正在寻求保护选择代码和数据的披露或修改的英特尔技术。 Intel® Software Guard Extensions存在权限提升漏洞。允许攻击者通过不正确早期系统状态损害系统固件影响SGX的安全。

Severity

高

Patch Name

Intel® Software Guard Extensions权限提升漏洞的补丁

Patch Description

Intel® Software Guard Extensions是应用开发者正在寻求保护选择代码和数据的披露或修改的英特尔技术。 Intel® Software Guard Extensions存在权限提升漏洞。允许攻击者通过不正确早期系统状态损害系统固件影响SGX的安全。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00076&languageid=en-fr

Reference

https://nvd.nist.gov/vuln/detail/CVE-2017-5691

Impacted products

Name
['Intel nuc6i5syk', 'Intel tk2m3w64cc', 'Intel stk2mv64cc', 'Intel nuc7i7bnh', 'Intel nuc7i5bnk']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-5691"
    }
  },
  "description": "Intel\u00ae Software Guard Extensions\u662f\u5e94\u7528\u5f00\u53d1\u8005\u6b63\u5728\u5bfb\u6c42\u4fdd\u62a4\u9009\u62e9\u4ee3\u7801\u548c\u6570\u636e\u7684\u62ab\u9732\u6216\u4fee\u6539\u7684\u82f1\u7279\u5c14\u6280\u672f\u3002\r\n\r\nIntel\u00ae Software Guard Extensions\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u5141\u8bb8\u653b\u51fb\u8005\u901a\u8fc7\u4e0d\u6b63\u786e\u65e9\u671f\u7cfb\u7edf\u72b6\u6001\u635f\u5bb3\u7cfb\u7edf\u56fa\u4ef6\u5f71\u54cdSGX\u7684\u5b89\u5168\u3002",
  "discovererName": "Intel",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00076\u0026languageid=en-fr",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-26598",
  "openTime": "2017-09-13",
  "patchDescription": "Intel\u00ae Software Guard Extensions\u662f\u5e94\u7528\u5f00\u53d1\u8005\u6b63\u5728\u5bfb\u6c42\u4fdd\u62a4\u9009\u62e9\u4ee3\u7801\u548c\u6570\u636e\u7684\u62ab\u9732\u6216\u4fee\u6539\u7684\u82f1\u7279\u5c14\u6280\u672f\u3002\r\n\r\nIntel\u00ae Software Guard Extensions\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u5141\u8bb8\u653b\u51fb\u8005\u901a\u8fc7\u4e0d\u6b63\u786e\u65e9\u671f\u7cfb\u7edf\u72b6\u6001\u635f\u5bb3\u7cfb\u7edf\u56fa\u4ef6\u5f71\u54cdSGX\u7684\u5b89\u5168\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Intel\u00ae Software Guard Extensions\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Intel nuc6i5syk",
      "Intel tk2m3w64cc",
      "Intel stk2mv64cc",
      "Intel nuc7i7bnh",
      "Intel nuc7i5bnk"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2017-5691",
  "serverity": "\u9ad8",
  "submitTime": "2017-07-27",
  "title": "Intel\u00ae Software Guard Extensions\u6743\u9650\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2017-5691 (GCVE-0-2017-5691)

Vulnerability from cvelistv5 – Published: 2017-07-26 15:00 – Updated: 2024-09-16 17:58

Summary

Incorrect check in Intel processors from 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Product Families, and Intel Xeon E3-1200 v5 and v6 Product Families allows compromised system firmware to impact SGX security via incorrect early system state.

Severity

No CVSS data available.

CWE

Elevation of Privilege

Assigner

intel mitre root Scorecard

References

3 references

URL	Tags
https://security-center.intel.com/advisory.aspx?i…	x_refsource_CONFIRM
https://support.lenovo.com/us/en/product_security…	x_refsource_CONFIRM
https://h20566.www2.hpe.com/hpsc/doc/public/displ…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Intel Corporation	6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Processor Families, and Intel Xeon E3-1200 v5 and v6 Product Families.	Affected: 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Processor Families, and Intel Xeon E3-1200 v5 and v6 Product Families.

Date Public

2017-07-25 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:11:48.513Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00076\u0026languageid=en-fr"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/product_security/LEN-15184"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesb3p03767en_us"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Processor Families, and Intel Xeon E3-1200 v5 and v6 Product Families.",
          "vendor": "Intel Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Processor Families, and Intel Xeon E3-1200 v5 and v6 Product Families."
            }
          ]
        }
      ],
      "datePublic": "2017-07-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect check in Intel processors from 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Product Families, and Intel Xeon E3-1200 v5 and v6 Product Families allows compromised system firmware to impact SGX security via incorrect early system state."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-15T19:57:01.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00076\u0026languageid=en-fr"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.lenovo.com/us/en/product_security/LEN-15184"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesb3p03767en_us"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "DATE_PUBLIC": "2017-07-25T00:00:00",
          "ID": "CVE-2017-5691",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Processor Families, and Intel Xeon E3-1200 v5 and v6 Product Families.",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Processor Families, and Intel Xeon E3-1200 v5 and v6 Product Families."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Intel Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Incorrect check in Intel processors from 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Product Families, and Intel Xeon E3-1200 v5 and v6 Product Families allows compromised system firmware to impact SGX security via incorrect early system state."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Elevation of Privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00076\u0026languageid=en-fr",
              "refsource": "CONFIRM",
              "url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00076\u0026languageid=en-fr"
            },
            {
              "name": "https://support.lenovo.com/us/en/product_security/LEN-15184",
              "refsource": "CONFIRM",
              "url": "https://support.lenovo.com/us/en/product_security/LEN-15184"
            },
            {
              "name": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesb3p03767en_us",
              "refsource": "CONFIRM",
              "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesb3p03767en_us"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2017-5691",
    "datePublished": "2017-07-26T15:00:00.000Z",
    "dateReserved": "2017-02-01T00:00:00.000Z",
    "dateUpdated": "2024-09-16T17:58:24.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-26598

CVE-2017-5691 (GCVE-0-2017-5691)

Tags

Sightings

Nomenclature

Related by attack behaviour