PT-2012-2151 · Intel+1 · Intel Trusted Execution Technology (Txt) Sinit Authenticated Code Modules+1

Joanna Rutkowska + 1 · Published 2012-09-15 · Updated 2017-12-13 · CVE-2011-5174

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) versions prior to 2nd gen i5 i7 SINIT 51.BIN Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) versions prior to i5 i7 DUAL SINIT 51.BIN Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) versions prior to i7 QUAD SINIT 51.BIN Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) versions prior to GM45 GS45 PM45 SINIT 51.BIN Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) versions prior to Q35 SINIT 51.BIN Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) versions prior to SINIT ACM 1.1

Description A buffer overflow issue exists in Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) that allows local users to bypass the Trusted Execution Technology protection mechanism. This issue can be exploited via unspecified vectors, allowing users to perform other unspecified SINIT ACM functions.

Recommendations For Intel Q67 Express, C202, C204, C206 Chipsets, and Mobile Intel QM67, and QS67 Chipset, update to 2nd gen i5 i7 SINIT 51.BIN or later. For Intel Q57, 3450 Chipsets and Mobile Intel QM57 and QS57 Express Chipset, update to i5 i7 DUAL SINIT 51.BIN and i7 QUAD SINIT 51.BIN or later. For Mobile Intel GM45, GS45, and PM45 Express Chipset, update to GM45 GS45 PM45 SINIT 51.BIN or later. For Intel Q35 Express Chipsets, update to Q35 SINIT 51.BIN or later. For Intel 5520, 5500, X58, and 7500 Chipsets, update to SINIT ACM 1.1 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-5174

SUSE-SU-2017:3276-1

SUSE-SU-2017_3276-1

Affected Products

Intel Trusted Execution Technology (Txt) Sinit Authenticated Code Modules

Suse

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2011-5174 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:3276-1 · Vendor Advisory
• http://secunia.com/advisories/47096 · Vendor Advisory
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71625 · Note
• https://lists.suse.com/pipermail/sle-security-updates/2017-December/003490.html · Note
• https://suse.com/support/update/announcement/2017/suse-su-20173276-1 · Note
• https://suse.com/security/cve/CVE-2011-5174.html · Note
• https://suse.com/security/cve/CVE-2011-5174 · Note
• https://bugzilla.suse.com/1069754 · Note
• http://theinvisiblethings.blogspot.com/2011/12/exploring-new-lands-on-intel-cpus-sinit.html · Note
• http://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00030&languageid=en-fr · Note
• http://osvdb.org/77554 · Note