PT-2018-2696 · Intel · Intel Rapid Storage Technology

Stefan Kanthak · Published 2018-11-14 · Updated 2021-03-26 · CVE-2018-3635

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Intel Rapid Store Technology (RST) versions prior to 16.7

Description The issue is related to insufficient input validation in the installer, which may allow an unprivileged user to potentially elevate privileges or cause an installer denial of service via local access. This could lead to arbitrary code execution with escalation of privilege via the Intel Rapid Storage Technology User Interface and Driver.

Recommendations For versions prior to 16.7, update to version 16.7 or later to resolve the issue. As a temporary workaround, consider restricting local access to the installer to minimize the risk of exploitation.

Fix

RCE

Improper Privilege Management

Weakness Enumeration

CWE-20

CWE-269

Related Identifiers

BDU:2019-01370

CVE-2018-3635

Affected Products

Intel Rapid Storage Technology

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2018-3635 · Security Note
• https://bdu.fstec.ru/vul/2019-01370 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00153.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3635 · Vendor Advisory
• http://seclists.org/fulldisclosure/2021/Mar/55 · Note
• http://securityfocus.com/bid/105984 · Note
• https://t.me/cvenotify/12083 · Telegram Post
• https://exploit.kitploit.com/2018/11/intel-rapid-storage-technology-user.html · Note
• https://t.me/defcon_news/72038 · Telegram Post