Intel CSME / SPS firmware (timing side channel): An observable timing discrepancy in CSME/SPS firmware allows

Impact

An observable timing discrepancy in CSME/SPS firmware allows a privileged local user to infer information from the management engine. Low direct impact; useful as a step toward key or state recovery from a component that is supposed to be opaque to the host.

Who can reach it

Privileged local access on the host.

What to do

Fixed in Intel CSME/SPS firmware, which reaches you as an OEM BIOS or firmware package - not as a microcode or OS update. That means: wait for your server vendor to ship it, drain the node, flash, and reboot. OEM availability is the long pole and routinely lags the Intel advisory by one or more quarters on server platforms. Track it per platform SKU, because vendors ship these unevenly across their own product lines.

References

Related entries

• Intel E810 Ethernet controller firmware: Improper input validation in E810 firmware lets a privileged local user denyCVE-2025-24296 · Intel E810 Ethernet controller firmwareMedium
• Intel Ethernet Controller E810 (100GbE) firmware: Uncaught exception in 100GbE E810 firmware, reachable from privilegedCVE-2025-24851 · Intel Ethernet Controller E810 (100GbE) firmwareMedium
• Intel Ethernet Controller E810 firmware: Out-of-bounds write inside E810 firmware, reachable from a privileged Ring-0CVE-2025-27243 · Intel Ethernet Controller E810 firmwareMedium
• HPE ProLiant RL300 Gen11 (UEFI firmware, out-of-bounds read): Out-of-bounds reads in the UEFI firmware of the ProLiantCVE-2025-37149 · HPE ProLiant RL300 Gen11 (UEFI firmware, out-of-bounds read)Medium
• NVIDIA DGX Spark: out-of-bounds read in standalone MM firmware discloses information across a scope boundaryCVE-2026-24225 · NVIDIA DGX Spark (standalone MM firmware)Medium
• NVIDIA DGX Spark: UEFI administrator password protection can be bypassed by a privileged local userCVE-2026-47624 · NVIDIA DGX Spark (UEFI administrator password protection)Medium