Intel Dynamic Tuning Technology Software Privilege Escalation (INTEL-SA-00875)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(180052);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/02/02");

  script_cve_id("CVE-2022-29470");
  script_xref(name:"IAVA", value:"2023-A-0427");

  script_name(english:"Intel Dynamic Tuning Technology Software Privilege Escalation (INTEL-SA-00875)");

  script_set_attribute(attribute:"synopsis", value:
"Intel Dynamic Tuning Technology (DTT) software on the remote host is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"Improper access control in the Intel DTT Software before version 8.7.10400.15482 may allow an authenticated user to 
potentially enable escalation of privilege via local access.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00875.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?267591f9");
  script_set_attribute(attribute:"see_also", value:"https://support.lenovo.com/us/en/product_security/LEN-140527");
  script_set_attribute(attribute:"solution", value:
"Update the Intel DTT Software to the latest version provided by the system manufacturer that addresses these issues.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-29470");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/08/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/08/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:intel:dynamic_tuning_technology");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("intel_dtt_detect.nbin");
  script_require_keys("installed_sw/Intel Dynamic Tuning Technology", "BIOS/Manufacturer", "BIOS/Model");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::get_app_info(app:'Intel Dynamic Tuning Technology');

vcf::check_granularity(app_info:app_info, sig_segments:4);

var fix_ver = '8.7.10400.15482';

var affected_dell_models = [
'Alienware Area 51m R1',
'Alienware m15 R2',
'Alienware m17 R2',
'Dell G7 15 7590',
'Dell G7 17 7790',
'Inspiron 3480',
'Inspiron 3481',
'Inspiron 3482',
'Inspiron 3502',
'Inspiron 3580',
'Inspiron 3581',
'Inspiron 3582',
'Inspiron 3583',
'Inspiron 3584',
'Inspiron 3780',
'Inspiron 3781',
'Inspiron 3782',
'Inspiron 5400 2-in-1',
'Inspiron 7300 2-in-1',
'Inspiron 7500 2-in-1 Black',
'Inspiron 7500 2-in-1 Silver',
'Inspiron 7590',
'Inspiron 7591',
'Latitude 13 3380',
'Latitude 3180',
'Latitude 3189',
'Latitude 3190 2-in-1',
'Latitude 3190',
'Latitude 3301',
'Latitude 3400',
'Latitude 3490',
'Latitude 3500',
'Latitude 3590',
'Latitude 5280',
'Latitude 5285 2-in-1',
'Latitude 5288',
'Latitude 5289',
'Latitude 5290',
'Latitude 5300 2-in-1',
'Latitude 5300',
'Latitude 5310 2-in-1',
'Latitude 5310',
'Latitude 5401',
'Latitude 5420 Rugged',
'Latitude 5424 Rugged',
'Latitude 5480',
'Latitude 5488',
'Latitude 5490',
'Latitude 5491',
'Latitude 5501',
'Latitude 5580',
'Latitude 5590',
'Latitude 5591',
'Latitude 7200 2-in-1',
'Latitude 7212 Rugged Extreme Tablet',
'Latitude 7280',
'Latitude 7285 2-in-1',
'Latitude 7290',
'Latitude 7300',
'Latitude 7380',
'Latitude 7389',
'Latitude 7390 2-in-1',
'Latitude 7390',
'Latitude 7400 2-in-1',
'Latitude 7400',
'Latitude 7424 Rugged Extreme',
'Latitude 7480',
'Latitude 7490',
'Precision 3520',
'Precision 3530',
'Precision 3541',
'Precision 5520',
'Precision 5540',
'Precision 7520',
'Precision 7530',
'Precision 7540',
'Precision 7720',
'Precision 7730',
'Precision 7740',
'Vostro 3480',
'Vostro 3481',
'Vostro 3580',
'Vostro 3581',
'Vostro 3582',
'Vostro 3583',
'Vostro 3584',
'Vostro 7590',
'XPS 13 9380',
'XPS 15 7590'
];

var affected_lenovo_models = [
  'M70q (type 11E8) Desktop (ThinkCentre)',
  'M70q Desktop (ThinkCentre)',
  'M70s Desktop (ThinkCentre)',
  'M70t Desktop (ThinkCentre)',
  'M80q Desktop (ThinkCentre)',
  'M80s Desktop (ThinkCentre)',
  'M80t Desktop (ThinkCentre)',
  'M90q Tiny Desktop (ThinkCentre)',
  'M90s Desktop (ThinkCentre)',
  'M90t Desktop (ThinkCentre)',
  'V50t-13IMB Desktop (Lenovo)',
  'E41-50 Laptop (Lenovo)',
  'IdeaPad Slim 5 14IAH8',
  'IdeaPad Slim 5 16IAH8',
  'IdeaPad 1 14IAU7 Laptop',
  'IdeaPad 1 15IAU7 Laptop',
  'IdeaPad 3 14IAU7 Laptop',
  'IdeaPad 3 15IAU7 Laptop',
  'IdeaPad 3 17IAU7 Laptop',
  'ideapad 3-14ITL6 Laptop',
  'ideapad 3-15ITL6 Laptop',
  'IdeaPad 3-17ITL6 Laptop',
  'ideapad 5 Pro-14ITL6 Laptop',
  'IdeaPad 5-14ITL05 Laptop',
  'Ideapad 5-15ITL05 Laptop',
  'IdeaPad Flex 5 14IRU8',
  'IdeaPad Flex 5 16IRU8',
  'IdeaPad Gaming 3 15IAH7 Laptop',
  'IdeaPad Gaming 3 16IAH7',
  'IdeaPad Gaming 3-15IHU6',
  'IdeaPad Pro 5 16IRH8',
  'IdeaPad Slim 3 14IAH8',
  'IdeaPad Slim 3 14IRH8',
  'IdeaPad Slim 3 14IRU8',
  'IdeaPad Slim 3 15IAH8',
  'IdeaPad Slim 3 15IRH8',
  'IdeaPad Slim 3 15IRU8',
  'IdeaPad Slim 3 16IAH8',
  'IdeaPad Slim 3 16IRH8',
  'IdeaPad Slim 3 16IRU8',
  'IdeaPad Slim 5 14IRL8',
  'IdeaPad Slim 5 16IRL8',
  'K14 G2 IRU',
  'L3-15ITL6 Laptop (ideapad)',
  'Legion 7 16IAX7',
  'Legion S7 16IAH7 Laptop (Lenovo)',
  'Legion S7 16IRH8',
  'Legion Slim 5 16IRH8',
  'Lenovo Flex 7 14IRU8',
  'Lenovo S14 G2 ITL',
  'Lenovo S14 G3 IAP',
  'Lenovo Slim 7 14IRP8',
  'Lenovo Slim 7 Carbon 13IRP8',
  'Lenovo Slim Pro 9 14IRP8',
  'Lenovo Slim Pro 9 16IRP8',
  'Lenovo V14 G3 IAP Laptop',
  'Lenovo V15 G3 IAP CTO',
  'Lenovo V15 G3 IAP Laptop',
  'Lenovo V17 G3 IAP Laptop',
  'LOQ 15IRH8',
  'LOQ 16IRH8',
  'ThinkBook 13x G2 IAP Laptop',
  'ThinkBook 14 G2 ITL Laptop',
  'ThinkBook 14 G3 ITL Laptop',
  'ThinkBook 14 G4 IAP',
  'ThinkBook 14 G5 IRL',
  'ThinkBook 14 G6 IRL',
  'ThinkBook 14s Yoga G2 IAP',
  'ThinkBook 14s Yoga G3 IRU',
  'ThinkBook 14s Yoga ITL',
  'ThinkBook 15 G2 ITL Laptop',
  'ThinkBook 15 G3 ITL Laptop',
  'ThinkBook 15 G4 IAP',
  'ThinkBook 15 G5 IRL',
  'ThinkBook 16 G6 IRL',
  'ThinkBook 16p G4 IRH',
  'V14 G2-ITL Laptop (Lenovo)',
  'V15 G2-ITL Laptop (Lenovo)',
  'V17 G2-ITL Laptop (Lenovo)',
  'Yoga 9-14ITL5 Laptop (ideapad)',
  'Yoga Book 9 13IRU8',
  'Yoga Pro 9 14IRP8',
  'Yoga Pro 9 16IRP8',
  'Yoga Slim 6 14IAP8',
  'Yoga Slim 6 14IRH8',
  'Yoga Slim 6 14IRP8',
  'Yoga Slim 7 Carbon 13IRP8',
  'L13 Gen 2 (type 20VH, 20VJ) Laptops (ThinkPad)',
  'L13 Yoga Gen 2 (type 20VL, 20VK) Laptops (ThinkPad)',
  'P340 Tiny Workstation (ThinkStation)',
  'P340 Workstation (ThinkStation)'
];

# special check to ignore unaffected dell models
# https://www.dell.com/support/kbdoc/en-us/000216232/dsa-2023-179-security-update-for-an-intel-product-update-2023-3-dtt-software-advisory
var bios_manufacturer = get_kb_item_or_exit('BIOS/Manufacturer');
var dell_model = get_kb_item_or_exit('BIOS/Model');

if (bios_manufacturer =~ "^[Dd]ell [Ii]nc" &&
  !collib::contains(affected_dell_models, dell_model))
  audit(AUDIT_DEVICE_NOT_VULN, dell_model);

if (bios_manufacturer =~ 'LENOVO')
{
  var lenovo_model = get_kb_item_or_exit('BIOS/Lenovo/ModelName');
  if (!collib::contains(affected_lenovo_models, lenovo_model))
    audit(AUDIT_DEVICE_NOT_VULN, lenovo_model);
}

var constraints = [
  { 'min_version' : '0', 'fixed_version' : fix_ver, 'fixed_display' : 'See vendor advisory'}
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING
);