High
A race condition in the firmware for some Intel processors may allow a privileged user to enable escalation of privilege via local access.
Improper buffer restrictions in a subsystem in the Intel CSME versions prior to 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, and 15.0.22 may allow a privileged user to enable escalation of privilege via local access.
A race condition in a subsystem in the Intel LMS versions prior to 2039.1.0.0 may allow a privileged user to enable escalation of privilege via local access.
Improper initialization in the firmware for some Intel processors may allow a privileged user to enable escalation of privilege via local access.
An out-of-bounds write in the firmware for some Intel processors may allow a privileged user to cause a denial-of-service condition via local access.
An out-of-bounds read in the firmware for some Intel processors may allow an authenticated user to enable an escalation of privilege via local access.
Improper input validation in the firmware for some Intel processors may allow an authenticated user to potentially enable a denial of service via local access.
Out-of-bounds read in a subsystem in the Intel CSME versions prior to 12.0.81, 13.0.47, 13.30.17, 14.1.53, and 14.5.32 may allow a privileged user to enable information disclosure via local access.
Improper initialization in a subsystem in the Intel CSME versions prior 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11, and 15.0.22 may allow a privileged user to enable information disclosure via local access.
Improper isolation of shared resources in some Intel processors may allow an authenticated user to enable information disclosure via local access.
An observable timing discrepancy in some Intel processors may allow an authenticated user to enable information disclosure via local access.
A domain-bypass transient execution vulnerability in some Intel Atom processors may allow an authenticated user to enable information disclosure via local access.
Refer to vendor advisory for the complete list of affected products and their respective patches at
https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf