PT-2020-4241 · Intel · Intel Txe+2

Eran Shimony · Published 2020-06-09 · Updated 2020-07-22 · CVE-2020-0539

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Intel(R) CSME versions prior to 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 Intel(R) TXE versions prior to 3.1.75, 4.0.25

Description: The issue is related to a path traversal vulnerability in the Intel Dynamic Application Loader (DAL) subsystem for Intel Converged Security and Manageability Engine (CSME) and Intel Trusted Execution Engine (TXE) software. This vulnerability may allow an unprivileged user to potentially enable denial of service via local access. The vulnerability is caused by incorrect restriction of access to a directory with limited access.

Recommendations: For Intel(R) CSME versions prior to 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33, update to version 11.8.77 or later, 11.12.77 or later, 11.22.77 or later, 12.0.64 or later, 13.0.32 or later, 14.0.33 or later. For Intel(R) TXE versions prior to 3.1.75, 4.0.25, update to version 3.1.75 or later, 4.0.25 or later. As a temporary workaround, consider restricting access to the vulnerable subsystem until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2020-04681

CVE-2020-0539

Affected Products

Intel Csme

Intel Dynamic Application Loader

Intel Txe

References · 8

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04681 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-0539 · Security Note
• https://osv.dev/vulnerability/CVE-2020-0539 · Vendor Advisory
• https://support.lenovo.com/de/en/product_security/len-30041 · Note
• https://t.me/cibsecurity/12782 · Telegram Post
• https://security.netapp.com/advisory/ntap-20200611-0006 · Note
• https://t.me/cvenotify/4352 · Telegram Post