Intel NUCs Hit With Five New Security Flaws

[erek]

Five separate CVEs

"The first flaw (CVE-2019-14608) is due to improper buffer restrictions in the NUC firmware, which could allow attackers to enable privilege escalation via local access to the device.

The second vulnerability (CVE-2019-14610) describes improper access control in NUC firmware that could allow an authenticated user to enable escalation of privilege via local access.

The third vulnerability (CVE-2019-14609) comes from improper input validation in firmware that also lead to privilege escalation via local access.

A fourth NUC firmware flaw (CVE-2019-14611) was an integer overflow that could result in the same type of attack.

The final flaw (CVE-2019-14612) is an out of bounds write in NUC firmware that attackers could also exploit to escalate system privileges via local access.

Besides all of the speculative execution attacks against its processors, Intel has also had to issue multiple security advisories for its NUC family of devices this year. The company has been attempting to prioritize security since the Spectre CPU vulnerabilities were revealed, and, in part, that means encouraging researchers to look for vulnerabilities on its platforms. "

https://www.tomshardware.com/news/intel-nuc-security-flaws-advisory-vulnerabilities

 

[DogsofJune]

Hmmm, may be time to re-purpose my Nuc. Nice find

 

[Meeho]

People bought those?

 

[DogsofJune]

I love mine. It's older but it travels well

 

[DogsofJune]

I love mine. It's older but it travels well

 

[IdiotInCharge]

I like how they had to move the word 'firmware' around to keep the flaw language from sounding repetitive -- these are five firmware vulnerabilities, and they're really only applicable to NUCs as those were wholly produced by Intel.

People bought those?

Plenty -- though they were meant to start a trend, essentially putting ultrabook 15w-class CPUs into small computers, they were popular because they worked, and for many, many uses, they were as small as you could get a 'full' desktop-class computer.

 

[KarsusTG]

They are actually pretty decent devices. They even have a gaming one that is pretty dang capable.

Also, all these vulnerabilities require local access. Local access = access for all intents and purposes, vulnerability or not.