Intel CSME / SPS firmware (timing side channel): An observable timing discrepancy in CSME/SPS firmware allows

Impact

An observable timing discrepancy in CSME/SPS firmware allows a privileged local user to infer information from the management engine. Low direct impact; useful as a step toward key or state recovery from a component that is supposed to be opaque to the host.

Who can reach it

Privileged local access on the host.

What to do

Fixed in Intel CSME/SPS firmware, which reaches you as an OEM BIOS or firmware package - not as a microcode or OS update. That means: wait for your server vendor to ship it, drain the node, flash, and reboot. OEM availability is the long pole and routinely lags the Intel advisory by one or more quarters on server platforms. Track it per platform SKU, because vendors ship these unevenly across their own product lines.

References