Intel AMT (HTTP handler) in Intel CSME firmware: A buffer overflow in AMT's HTTP handler allows arbitrary code

CVSS 8.8CVE-2018-3628Firmware, BMC & network fabriccurated

Impact

A buffer overflow in AMT's HTTP handler allows arbitrary code execution with AMT privileges. AMT's HTTP handler is what serves the out-of-band management interface, so exploitation gives the attacker the same below-the-OS control AMT itself has.

Who can reach it

Reachable through the AMT network interface on provisioned machines.

What to do

Fixed in Intel CSME/SPS firmware, which reaches you as an OEM BIOS or firmware package - not as a microcode or OS update. That means: wait for your server vendor to ship it, drain the node, flash, and reboot. OEM availability is the long pole and routinely lags the Intel advisory by one or more quarters on server platforms. Track it per platform SKU, because vendors ship these unevenly across their own product lines. Immediate compensating control is to unprovision AMT where you do not use it and firewall the AMT ports where you do.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-3628 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.