Intel® NUC Firmware Advisory

Summary:

Potential security vulnerabilities in some Intel® NUC BIOS firmware may allow escalation of privilege or denial of service. Intel is releasing firmware updates to mitigate these potential vulnerabilities.****

Vulnerability Details:

CVEID: CVE-2021-33164

Description: Improper access control in BIOS firmware for some Intel® NUCs before version INWHL357.0046 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 8.2 High

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-33176

Description: Improper input validation in BIOS firmware for some Intel® NUC 11 Performance kits and Intel® NUC 11 Performance Mini PCs before version PATGL357.0042 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 8.2 High

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-37345

Description: Improper authentication in BIOS firmware for some Intel® NUC Kits before version RY0386 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.8 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-21794

Description: Improper authentication in BIOS firmware for some Intel® NUC Boards, Intel® NUC Business, Intel® NUC Enthusiast, Intel® NUC Kits before version HN0067 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.7 High

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

CVEID: CVE-2022-34152

Description: Improper input validation in BIOS firmware for some Intel® NUC Boards, Intel® NUC Kits before version TY0070 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.7 High

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

CVEID: CVE-2022-32569

Description: Improper buffer restrictions in BIOS firmware for some Intel® NUC M15 Laptop Kits before version BCTGL357.0074 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-36789

Description: Improper access control in BIOS firmware for some Intel® NUC 10 Performance Kits and Intel® NUC 10 Performance Mini PCs before version FNCML357.0053 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-35276

Description: Improper access control in BIOS firmware for some Intel® NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-38099

Description: Improper input validation in BIOS firmware for some Intel® NUC 11 Compute Elements before version EBTGL357.0065 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-26124

Description: Improper buffer restrictions in BIOS firmware for some Intel® NUC Boards, Intel® NUC 8 Boards, Intel® NUC 8 Rugged Boards and Intel® NUC 8 Rugged Kits before version CHAPLCEL.0059 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-36370

Description: Improper authentication in BIOS firmware for some Intel® NUC Boards and Intel® NUC Kits before version MYi30060 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-37334

Description: Improper initialization in BIOS firmware for some Intel® NUC 11 Pro Kits and Intel® NUC 11 Pro Boards before version TNTGL357.0064 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.0 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-36349

Description: Insecure default variable initialization in BIOS firmware for some Intel® NUC Boards and Intel® NUC Kits before version MYi30060 may allow an authenticated user to potentially enable denial of service via local access.

CVSS Base Score: 5.2 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L****

Affected Products:

Product

|

Download Link

|

CVE ID

—|—|—

Intel® NUC Mini PC NUC8i7INH and NUC8i5INH.

|

INWHL357.0046

|

CVE-2021-33164

Intel® NUC 11 Performance kit – NUC11PAHi70Z, NUC11PAHi50Z, NUC11PAHi30Z, NUC11PAHi3, NUC11PAHi5, NUC11PAHi7, NUC11PAKi3, NUC11PAKi5, NUC11PAKi7.

Intel® NUC 11 Performance Mini PC - NUC11PAQi50WA, NUC11PAQi70QA.

|

BIOS Update [PATGL357]

|

CVE-2022-33176

CVE-2022-38099

Intel® NUC Kit - NUC5i3RYH, NUC5i7RYH, NUC5i5RYK, NUC5i5RYH, NUC5i3RYK, NUC5i5RYHS, NUC5i3RYHS, NUC5i3RYHSN.

|

BIOS Update [RYBDWi35]

|

CVE-2022-37345

Intel® NUC Kit - NUC8i7HNK, NUC8i7HVK.

Intel® NUC 8 Enthusiast - NUC8i7HVKVA, NUC8i7HVKVAW.

Intel® NUC 8 Business - NUC8i7HNKQC.

|

BIOS Update [HNKBLi70]

|

CVE-2022-21794

Intel® NUC Kit - DE3815TYKHE.

Intel® NUC Board - DE3815TYBE.

|

BIOS Update [TYBYT10H]

|

CVE-2022-34152

Intel® NUC M15 Laptop Kit

|

BIOS Update for the Intel® NUC M15 Laptop Kit

|

CVE-2022-32569

Intel® NUC 10 Performance kit - NUC10i7FNHN, NUC10i5FNKN, NUC10i5FNHN, NUC10i7FNKN, NUC10i3FNHN, NUC10i3FNKN.

Intel® NUC 10 Performance Mini PC - NUC10i5FNHJA, NUC10i3FNHF, NUC10i7FNKPA, NUC10i5FNHCA, NUC10i3FNHFA, NUC10i5FNHJ, NUC10i7FNHC, NUC10i7FNHJA, NUC10i3FNHJA, NUC10i3FNK, NUC10i7FNHAA, NUC10i5FNH, NUC10i5FNK, NUC10i7FNH, NUC10i5FNHF, NUC10i5FNKPA, NUC10i3FNH, NUC10i7FNK, NUC10i7FNKP, NUC10i5FNKP.

|

BIOS Update [FNCML357]

|

CVE-2022-36789

Intel® NUC 8 Compute Element - CM8i7CB, CM8i3CB, CM8CCB, CM8i5CB, CM8PCB.

|

BIOS Update [CBWHL357]

|

CVE-2022-35276

Intel® NUC 8 Rugged Kit NUC8CCHKRN, NUC8CCHKR.

Intel® NUC 8 Rugged Board - NUC8CCHBN.

Intel® NUC Board - NUC8CCHB.

|

BIOS Update [CHAPLCEL]

|

CVE-2022-26124

Intel® NUC Board - NUC5i3MYBE.

Intel® NUC Kit - NUC5i3MYHE.

|

BIOS Update [MYBDWi30]

|

CVE-2022-36370

Intel® NUC 11 Pro Kit - NUC11TNHi70Z, NUC11TNKi70Z, NUC11TNKi30Z, NUC11TNHi30Z, NUC11TNKi50Z, NUC11TNHi50Z, NUC11TNBi30Z, NUC11TNBi50Z, NUC11TNBi70Z, NUC11TNHi3, NUC11TNHi5.

|

BIOS Update [TNTGL357]

|

CVE-2022-37334

CVE-2022-38099

Intel® NUC Board - NUC5i3MYBE.

Intel® NUC Kit - NUC5i3MYHE.

|

BIOS Update [MYBDWi30]

|

CVE-2022-36349

Intel® NUC 11 Compute Element - CM11EBC4W, CM11EBi38W, CM11EBi58W, CM11EBi716W

Intel® NUC 11 Extreme Compute Element - NUC11DBBi9, NUC11DBBi7

|

BIOS Update [EBTGL357]__

BIOS Update [DBTGL579]__

| CVE-2022-38099

Recommendations:

Intel recommends updating the affected Intel® NUC BIOS firmware to the latest version (see provided table above).

Acknowledgements:

The following issues were found internally by Intel employees; CVE-2021-33164 and CVE-2022-37334. Intel would like to thank Benny Zeltser, Yehonatan Lusky (CVE-2021-33164) and Brent Holtsclaw (CVE-2022-37334).

Intel would like to thank Yngweijw (Jiawei Yin) (CVE-2022-33176, CVE-2022-37345, CVE-2022-21794, CVE-2022-34152, CVE-2022-36789, CVE-2022-35276, CVE-2022-36370), the BINARLY efiXplorer team (CVE-2022-32569), Dmitry Frolov (CVE-2022-26124, CVE-2022-38099) and the TCG Vulnerability Response Team (CVE-2022-36349).****

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.