topic Re: Re:ICLS Client CVE-2024-5535 in Mobile and Desktop Processors

ICLS Client CVE-2024-5535

Mat9 — Tue, 03 Dec 2024 10:55:51 GMT

The Intel ICLS Client driver product seems to be vulnerable to CVE-2024-5535.

This product is installed on several Dell Precision laptops.

Path to the vulnerable component:

C:\Windows\System32\DriverStore\FileRepository\iclsclient.inf_amd64_*\lib\libssl-3-x64.dll

For SSL to be vulnerable, two conditions must be met:

The OpenSSL version is lesser than 3.0.15
The application is able to call the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer

Please suggest whether Intel released patched versions for the ICLS Client or if this vulnerability has been mitigated.

Thank you very much.

Re:ICLS Client CVE-2024-5535

JedG_Intel — Mon, 23 Dec 2024 01:38:07 GMT

Hello Mat9,

Thank you for posting on Intel Community Forum.

Please provide the processor model used on the laptops. Once provided, I'll be checking this internally.

I look forward to your response!

Best regards,

Jed G.

Intel Customer Support Technician

Re: Re:ICLS Client CVE-2024-5535

Mat9 — Mon, 23 Dec 2024 10:46:03 GMT

Hello JedG.

Please see below:

Dell Precision M5520	Intel i7-7820HQ (Quad Core HT, 8MB Cache, 2.90GHz)
Dell Precision M5530	Intel Core i7-8850H Six Core 2.60GHz, 4.30 GHz Turbo, 9MB 45W
Dell Precision M5540	Intel Core i7-9850H Six Core 2.60GHz, 4.60 GHz Turbo, 12MB 45W
Dell Mobile Precision 7550 CTO BASE	Intel Core i7-10850H Six Core 2.70GHz 5.10Ghz Turbo, 12MB 45W
Dell Latitude 5530	12th Gen Intel® Core™ i5-1245U 1.6GHz
HP Elite Dragonfly 13.5 inch G3 Notebook PC	12th Gen Intel(R) Evo Core(TM) i7-1265U 1782 MHz
HP Z2 Mini G9	Intel i9-12900K 16C 3.20 125W

Thank you!

Re: Re:ICLS Client CVE-2024-5535

DouglasR — Mon, 23 Dec 2024 22:00:58 GMT

Hi there. I see so many threads regarding this CVE and others with OpenSSL vulnerabilities at these paths

c:\windows\system32\driverstore\filerepository\iclsclient.inf_amd64_fc84dfa25a6a7727\lib\libcrypto-3-x64.dll

c:\windows\system32\driverstore\filerepository\iclsclient.inf_amd64_fc84dfa25a6a7727\lib\libssl-3-x64.dll

Related to the iCLS Client Driver version 1.71.99.00.

Have I missed something? Is there not an updated driver for this yet?

Re:ICLS Client CVE-2024-5535

JedG_Intel — Thu, 26 Dec 2024 06:08:19 GMT

Hi Mat9,

Thank you for sharing this information. I will now check this internally and I'll give you an update as soon as possible.

Best regards,

Jed G.

Intel Customer Support Technician

Re:ICLS Client CVE-2024-5535

JedG_Intel — Fri, 27 Dec 2024 05:46:04 GMT

Hi Mat9,

I have reviewed your concern internally and to report a vulnerability, please send an email to secure@intel.com.

For detailed instructions, please refer to this - How Do I Report Security and Vulnerability Issues Related to Intel® Products?

I hope this addresses your concern. Should you have any further questions, please feel free to reach out.

Best regards,

Jed G.

Intel Customer Support Technician

Re:ICLS Client CVE-2024-5535

JedG_Intel — Thu, 02 Jan 2025 23:53:57 GMT

Hello Mat9,

I wanted to check if you had the chance to check the information I posted. Should you have other questions, please let me know.

Best regards,

Jed G.

Intel Customer Support Technician

Re: Re:ICLS Client CVE-2024-5535

Mat9 — Fri, 03 Jan 2025 09:45:54 GMT

Hello JedG.

Thank you for sharing the contact details!

Hopefully, the PSIRT can help.

Re:ICLS Client CVE-2024-5535

JedG_Intel — Tue, 07 Jan 2025 06:35:18 GMT

Hi Mat9,

I really hope for the best too and I'm glad that I was able to share this information with you. Please advise if I can close this inquiry or if you have other questions so I could continue accordingly.

Best regards,

Jed G.

Intel Customer Support Technician

Re:ICLS Client CVE-2024-5535

JedG_Intel — Sun, 12 Jan 2025 23:44:01 GMT

Hi Mat9,

I have not heard back from you so I will close this inquiry now. If you need further assistance, please submit a new question as this thread will no longer be monitored.

Best regards,

Jed G.

Intel Customer Support Technician