Benny Zeltser

**Name of the Vulnerable Software and Affected Versions** Intel(R) Server Board S2600WF versions prior to 02.01.0017 Intel(R) Server Board S2600ST versions prior to 02.01.0017 Intel(R) Server Board S2600BP versions prior to 02.01.0017 Intel(R) Server Board M50CYP versions prior to R01.01.0009 Intel(R) Server Board D50TNP versions prior to R01.01.0009 **Description** The issue is related to improper access control in the BMC Firmware for several Intel Server Board models. This may allow an authenticated user to enable escalation of privilege via local access. **Recommendations** For Intel(R) Server Board S2600WF versions prior to 02.01.0017, update to version 02.01.0017 or later. For Intel(R) Server Board S2600ST versions prior to 02.01.0017, update to version 02.01.0017 or later. For Intel(R) Server Board S2600BP versions prior to 02.01.0017, update to version 02.01.0017 or later. For Intel(R) Server Board M50CYP versions prior to R01.01.0009, update to version R01.01.0009 or later. For Intel(R) Server Board D50TNP versions prior to R01.01.0009, update to version R01.01.0009 or later.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Graphics Drivers (affected versions not specified) **Description** The issue is related to improper buffer restrictions in Intel(R) Graphics Drivers, which may allow an authenticated user to potentially enable denial of service via local access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) OFU software versions prior to 14.1.30 **Description** The issue is related to improper access control in kernel mode driver, which may allow a privileged user to potentially enable escalation of privilege via local access. **Recommendations** For versions prior to 14.1.30, update to version 14.1.30 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Intel(R) NUCs versions prior to INWHL357.0046 **Description** The issue is related to improper access control in BIOS firmware, which may allow a privileged user to potentially enable escalation of privilege via local access. It is also associated with a vulnerability in UEFI firmware, known as RingHopper, that allows code execution at the System Management Mode (SMM) level, providing unrestricted access to system memory. This vulnerability is linked to the possibility of conducting a timing attack using Direct Memory Access (DMA) to damage memory in SMM-level code. The presence of this vulnerability has been confirmed in Intel, Dell, and Insyde Software firmware, while AMD, Phoenix, and Toshiba firmware are not affected. **Recommendations** For Intel(R) NUCs versions prior to INWHL357.0046, update the BIOS firmware to version INWHL357.0046 or later to resolve the issue. As a temporary workaround, consider restricting local access to the system to minimize the risk of exploitation. Avoid using DMA for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Dell BIOS (affected versions not specified) **Description** Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.