Intel Security Vulnerabilities Regarding Intel® Management Engine (ME), Intel® Server Platform Services (SPS), and Intel® Trusted Execution Engine (TXE)

NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Source: Intel® Article ID: 000025619 (Intel SA-00086)

Potential Security Impact: Toshiba is aware of the Intel® ME/TXE Elevation of privileges vulnerability, and we are diligently working to provide updates for all impacted models. The security and privacy of customers' information are priorities for Toshiba. Toshiba is working closely with Intel to address the situation and are working to release firmware updates to fix the security vulnerability.  Firmware update details for these platforms will be added to this document as they become available and we recommend customers update their systems to the latest Intel Management Engine Firmware and iCLS Software by downloading the updates as they become available.

Toshiba highly recommends system owners ensure that systems are physically secured where possible, and follow good security practices to ensure that only authorized personnel have hands-on access to devices.

In addition, Toshiba encourages customers to review Intel’s Security Advisory for information, including appropriate identification and mitigation measures. To determine if the identified vulnerabilities impacts your system, download and run the Intel-SA-00086 Detection tool using the links below.

Available resources

• Intel Security Advisory (INTEL-SA-00086) https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr
• Intel Detection Guide and Discovery Tool https://downloadcenter.intel.com/download/27150
• Intel® Management Engine (ME) 11.x: CVE-2017-5705 , CVE-2017-5708, CVE-2017-5711, CVE-2017-5712
• Intel® Server Platform Service 4.0.x.x : CVE-2017-5706 , CVE-2017-5709
• Intel® Trusted Execution Engine (TXE) 3.0 : CVE-2017-5707 , CVE-2017-5710 

Firmware Release Details:

• Dates in this list are provided for customer planning purposes and will be updated with links to downloadable packages when available.

• Check Table below to see if your system has been impacted and the vulnerability update is available.
  • No actions are required if you system is not listed.
• Download and install the latest firmware update.
  • The systems below are affected and will require the Intel firmware update. 

Installation Order Details:

1. Update your Intel AMT Software first. 
2. Update the firmware of Intel Management Engine

Toshiba’s ME Firmware Release Schedule:

* The information in this document is subject to change without notice.

* "Intel" is a trademark of Intel Corporation in the U.S. and other countries.

* Other names and brands may be claimed as the property of others.