CVE-2016-8103

Vulnerability

An SMM call out vulnerability exists in all Intel Branded NUC Kits. The bug resides in the System Management Mode (SMM) code, allowing a local privileged user to invoke an SMM call out that executes arbitrary code within SMM. This affects all Intel NUC Kits prior to the firmware update released in response to this advisory [1].

Exploitation

An attacker must have local access to the system and possess elevated privileges (e.g., root or administrator). The exploitation sequence involves triggering the vulnerable SMM call out, which then executes attacker-controlled code in SMM context. No user interaction beyond initial access is required [1].

Impact

Successful exploitation grants the attacker full control of the platform. Since SMM operates below the operating system, the attacker can bypass OS security mechanisms, install persistent firmware-level malware, and access sensitive data. The compromise is at the highest privilege level on the platform [1].

Mitigation

Intel released firmware updates to address this vulnerability. Affected users should update their Intel NUC Kit firmware to the latest version provided by Intel. The advisory [1] contains specific version information and download links. No workarounds are available; updating firmware is the only mitigation.