Intel BIOS SINIT Authenticated Code Module Local Privilege Escalation Vulnerability

Bugtraq ID:	37430
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Dec 21 2009 12:00AM
Updated:	Dec 29 2009 03:12PM
Credit:	Alexander Tereshkin, Rafal Wojtczuk, and Joanna Rutkowska from Invisible Things Lab
Vulnerable:	Intel Q45 0 Intel Q43 Express 0 Intel Q35 0 Intel PM45 Express 0 Intel GM45 0
Not Vulnerable:

Intel BIOS SINIT Authenticated Code Module Local Privilege Escalation Vulnerability

Intel BIOS is prone to an unspecified privilege-escalation vulnerability.

Successful exploits will allow local processes to bypass intended security restrictions and gain elevated privileges.

Currently very few technical details are available. We will update this BID as more information emerges.

Intel BIOS SINIT Authenticated Code Module Local Privilege Escalation Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Intel BIOS SINIT Authenticated Code Module Local Privilege Escalation Vulnerability

Solution:
Intel has released fixes; please see the references for details.

Intel BIOS SINIT Authenticated Code Module Local Privilege Escalation Vulnerability

References:

• Intel Homepage (Intel)
  
• INTEL-SA-00021: SINIT misconfiguration allows for Privilege Escalation (Intel)