Full Report
Intel has published information on vulnerabilities in Intel products in November 2019. In this advisory Siemens only explicitly mentions the vulnerabilities from the “Intel® CPU Security Advisory” and one vulnerability from “Intel® CSME, Intel® SPS, Intel® TXE, Intel® AMT, Intel® PTT and Intel® DAL Advisory” and lists the Siemens IPC related products that are affected by these vulnerabilities. For further information about BIOS updates related to Intel CPU vulnerabilities see: https://support.industry.siemens.com/cs/ww/en/view/109747626. Several Siemens Industrial Products contain processors that are affected by the vulnerabilities. Siemens has released updates for several affected products and is currently working on BIOS updates that include chipset microcode updates for further products.
Analysis Summary
Based on the Intel November 2019 security updates and the associated Siemens advisory, here is the summarized vulnerability information.
# Vulnerability: Intel CPU and Management Engine Microcode Flaws (Nov 2019)
## CVE Details
*Note: This advisory covers multiple CVEs related to the Intel November 2019 platform update.*
- **CVE ID:** CVE-2019-0117, CVE-2019-11135, CVE-2019-11139, CVE-2018-12207, CVE-2019-0169
- **CVSS Score:** 7.2 - 8.8 (High)
- **CWE:** CWE-200 (Information Exposure), CWE-400 (Resource Exhaustion)
## Affected Systems
- **Products:** Siemens Industrial PCs (IPC), SIMATIC Field PGs, and various Siemens Industrial products containing Intel processors.
- **Affected Models:**
- SIMATIC IPC (227, 277, 427, 477, 627, 647, 677, 827, 847 series)
- SIMATIC Field PG M4, M5, M6
- SIMATIC IPCs for specific applications (e.g., IPC127E, IPC347E)
- **Versions:** All firmware versions prior to the BIOS/Microcode updates released in late 2019/early 2020.
## Vulnerability Description
The vulnerabilities stem from hardware and firmware flaws in Intel CPUs and management subsystems:
1. **TSX Asynchronous Abort (TAA):** Similar to MDS/ZombieLoad, flaws in Intel Transactional Synchronization Extensions (TSX) allow local attackers to leak information from internal CPU buffers.
2. **Machine Check Error Avoidance:** A flaw in how processors handle memory page size changes (CVE-2018-12207), potentially allowing a malicious guest VM to cause a Denial of Service (System Hang) on the host.
3. **Intel CSME/AMT Flaws:** Improper leakage of sensitive data in the Converged Security and Management Engine (CSME) and Active Management Technology (AMT).
## Exploitation
- **Status:** PoCs available for TAA and MDS-related variants.
- **Complexity:** Medium to High (requires specific timing and local code execution).
- **Attack Vector:** Local (for TAA/MDS variants) or Adjacent (for certain AMT vulnerabilities).
## Impact
- **Confidentiality:** High (Potential leakage of kernel memory, passwords, or cryptographic keys).
- **Integrity:** None reported for the CPU-specific flaws.
- **Availability:** High (System hang or crash via CVE-2018-12207).
## Remediation
### Patches
Siemens is releasing BIOS updates that include Intel’s updated microcode.
- Users should navigate to the Siemens Industry Online Support (SIOS) portal to download specific BIOS updates for their IPC model.
- **Status:** Updates have been released for newer generation IPCs (e.g., IPCx27E, IPCx77E); older models are under evaluation or updates are in progress.
### Workarounds
- **Disable Intel TSX:** If the BIOS supports it, disabling TSX can mitigate CVE-2019-11135.
- **Disable Hyper-Threading:** Can reduce the surface area for side-channel attacks.
- **Software Mitigations:** Ensure the host Operating System (Windows/Linux) has the latest security patches installed to complement the BIOS updates.
## Detection
- **Detection methods:** Use the **Intel CSME Detection Tool** to verify if the management engine is vulnerable.
- **Indicators of compromise:** These are hardware-level side-channel attacks; standard log-based detection is generally ineffective. Monitoring for unusual CPU utilization or unauthorized guest-to-host memory access attempts is recommended.
## References
- Siemens Security Advisory: hxxps://support.industry.siemens.com/cs/ww/en/view/109747626
- Intel Security Advisory (CPU): hxxps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
- Intel Security Advisory (CSME): hxxps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html