Intel® Stratix® 10 FPGA SDM for Intel® Quartus® Prime Pro Advisory

Summary:

Potential security vulnerabilities in the Intel® Stratix® 10 FPGA firmware provided with Intel® Quartus® Prime Pro software may allow privilege escalation and/or information disclosure.** Intel is releasing software updates to mitigate these potential vulnerabilities.**

Vulnerability Details

CVEID: CVE-2020-8737

Description: Improper buffer restrictions in the Intel® Stratix® 10 FPGA firmware provided with the Intel® Quartus® Prime Pro software before version 20.1 may allow an unauthenticated user to potentially enable escalation of privilege and/or information disclosure via physical access.

CVSS Base Score: 7.3 High

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVEID: CVE-2020-12312

Description: Improper buffer restrictions in the Intel® Stratix® 10 FPGA firmware provided with the Intel® Quartus® Prime Pro software before version 20.2 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

CVSS Base Score: 4.9 Medium

CVSS Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Affected Products:

Intel® Quartus® Prime Pro before version 20.2.

Recommendations:

Intel recommends taking the following steps in order to mitigate this potential vulnerability. Detailed instructions are provided in the application note AN-923 Updating Intel® Stratix® 10 FPGA Firmware.

· Update Intel® Quartus® Prime Pro to 20.2 or later.

· Update Intel Stratix® 10 FPGA firmware.

· Intel recommends cancelling Intel® Stratix® 10 FPGA firmware key cancellation IDs for all prior versions of firmware, which includes IDs 0 through 6. If the AES root key was programmed using firmware from Intel® Quartus® Prime Pro software version 19.4 or earlier, contact Intel Support. Refer to this user guide for details.

Updates to Intel® Quartus® Prime Pro are available for download at this location: <https://fpgasoftware.intel.com/?edition=pro&gt;

Acknowledgements:

This issue was found internally by Intel employees. Intel would like to thank Greg Alexander.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.