CVE-2018-3652 Information disclosure in Intel Xeon Processor
A limited physical presence attacker can access platform secrets via debug interfaces due to existing UEFI setting restrictions in Intel Xeon processors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-3652?
CVE-2018-3652 is a high-severity vulnerability in Intel Xeon Processor, published on 10 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon Scalable processors, and Intel Xeon Processor D Family allows a limited physical presence attacker to potentially access platform secrets via debug interfaces.
Weakness: CWE-200
Which versions are affected by CVE-2018-3652?
It affects 34 products.
Products include Intel Atom C, Intel Xeon, Intel Xeon Bronze 3104, Intel Xeon Bronze 3106, Intel Xeon E3, Intel Xeon E3 1220 V5 and 28 more.
How do I fix CVE-2018-3652?
No fix has been published for CVE-2018-3652 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-3652 being exploited?
There is no known exploitation of CVE-2018-3652 in the wild and no public exploit code.
Sources
Also known as GHSA-jh7f-g95c-2jp7.