PT-2020-4146 · Intel · Intel Txe+2

Published 2020-06-09 · Updated 2020-07-22 · CVE-2020-0545

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Intel CSME versions prior to 11.8.77 Intel CSME versions prior to 11.12.77 Intel CSME versions prior to 11.22.77 Intel TXE versions prior to 3.1.75 Intel TXE versions prior to 4.0.25 Intel Server Platform Services (SPS) versions prior to SPS E5 04.01.04.380.0 Intel Server Platform Services (SPS) versions prior to SPS SoC-X 04.00.04.128.0 Intel Server Platform Services (SPS) versions prior to SPS SoC-A 04.00.04.211.0 Intel Server Platform Services (SPS) versions prior to SPS E3 04.01.04.109.0 Intel Server Platform Services (SPS) versions prior to SPS E3 04.08.04.070.0

Description: The issue is related to an integer overflow in the subsystem for Intel Converged Security and Manageability Engine, Intel Server Platform Services, and Intel Trusted Execution Engine. This may allow a privileged user to potentially enable denial of service via local access.

Recommendations: For Intel CSME versions prior to 11.8.77, update to version 11.8.77 or later. For Intel CSME versions prior to 11.12.77, update to version 11.12.77 or later. For Intel CSME versions prior to 11.22.77, update to version 11.22.77 or later. For Intel TXE versions prior to 3.1.75, update to version 3.1.75 or later. For Intel TXE versions prior to 4.0.25, update to version 4.0.25 or later. For Intel Server Platform Services (SPS) versions prior to SPS E5 04.01.04.380.0, update to version SPS E5 04.01.04.380.0 or later. For Intel Server Platform Services (SPS) versions prior to SPS SoC-X 04.00.04.128.0, update to version SPS SoC-X 04.00.04.128.0 or later. For Intel Server Platform Services (SPS) versions prior to SPS SoC-A 04.00.04.211.0, update to version SPS SoC-A 04.00.04.211.0 or later. For Intel Server Platform Services (SPS) versions prior to SPS E3 04.01.04.109.0, update to version SPS E3 04.01.04.109.0 or later. For Intel Server Platform Services (SPS) versions prior to SPS E3 04.08.04.070.0, update to version SPS E3 04.08.04.070.0 or later.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2020-04568

CVE-2020-0545

Affected Products

Intel Csme

Intel Server Platform Services

Intel Txe

References · 9

• https://osv.dev/vulnerability/CVE-2020-0545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0545 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04568 · Security Note
• https://support.lenovo.com/de/en/product_security/len-30041 · Note
• https://t.me/cvenotify/4357 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-631949.pdf · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10321 · Note
• https://security.netapp.com/advisory/ntap-20200611-0006 · Note