PT-2019-3838 · Intel · Intel Txe+1

Published 2019-11-12 · Updated 2020-01-02 · CVE-2019-11087

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Intel(R) CSME versions prior to 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10, and 14.0.10 Intel(R) TXE versions prior to 3.1.70 and 4.0.20

Description The issue is related to insufficient input validation in the Intel(R) CSME and Intel(R) TXE subsystems, which may allow a privileged user to potentially enable escalation of privilege, information disclosure, or denial of service via local access. This could lead to the disclosure of protected information, privilege escalation, or service disruption.

Recommendations For Intel(R) CSME versions prior to 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10, and 14.0.10, update to version 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10, or 14.0.10, respectively. For Intel(R) TXE versions prior to 3.1.70 and 4.0.20, update to version 3.1.70 or 4.0.20, respectively. As a temporary workaround, consider restricting local access to the subsystems until a patch is applied.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-04197

CVE-2019-11087

Affected Products

Intel Csme

Intel Txe

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-11087 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11087 · Vendor Advisory
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04197 · Security Note