PT-2018-2696 · Intel · Intel Rapid Storage Technology

Stefan Kanthak · Publicado 2018-11-14 · Atualizado 2021-03-26 · CVE-2018-3635

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Intel Rapid Store Technology (RST) versions prior to 16.7

Description The issue is related to insufficient input validation in the installer, which may allow an unprivileged user to potentially elevate privileges or cause an installer denial of service via local access. This could lead to arbitrary code execution with escalation of privilege via the Intel Rapid Storage Technology User Interface and Driver.

Recommendations For versions prior to 16.7, update to version 16.7 or later to resolve the issue. As a temporary workaround, consider restricting local access to the installer to minimize the risk of exploitation.

Correção

RCE

Improper Privilege Management

Enumeração de Fraquezas

CWE-20

CWE-269

Identificadores relacionados

BDU:2019-01370

CVE-2018-3635

Produtos afetados

Intel Rapid Storage Technology

Referências · 9

• http://seclists.org/fulldisclosure/2021/Mar/55 · Nota
• http://securityfocus.com/bid/105984 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3635 · Nota de Segurança
• https://t.me/cvenotify/12083 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2019-01370 · Nota de Segurança
• https://exploit.kitploit.com/2018/11/intel-rapid-storage-technology-user.html · Nota
• https://intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00153.html · Aviso do Fabricante
• https://t.me/defcon_news/72038 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-3635 · Aviso do Fabricante