PT-2020-4737 · Intel · Intel Sps+1

Published 2020-11-10 · Updated 2020-11-20 · CVE-2020-8755

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Intel CSME versions prior to 12.0.70 Intel CSME versions prior to 14.0.45 Intel SPS versions prior to E5 04.01.04.400 Intel SPS versions prior to E3 05.01.04.200

Description: The issue is caused by a race condition in the subsystem for Intel Converged Security and Manageability Engine (CSME) and Intel Server Platform Services (SPS) due to synchronization errors when using a shared resource. This may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

Recommendations: For Intel CSME versions prior to 12.0.70, update to version 12.0.70 or later. For Intel CSME versions prior to 14.0.45, update to version 14.0.45 or later. For Intel SPS versions prior to E5 04.01.04.400, update to version E5 04.01.04.400 or later. For Intel SPS versions prior to E3 05.01.04.200, update to version E3 05.01.04.200 or later.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2020-05289

CVE-2020-8755

Affected Products

Intel Csme

Intel Sps

References · 9

• https://bdu.fstec.ru/vul/2020-05289 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00391 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8755 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8755 · Security Note
• https://security.netapp.com/advisory/ntap-20201113-0002 · Note
• https://t.me/cibsecurity/16228 · Telegram Post
• https://t.me/cvenotify/5915 · Telegram Post
• https://security.netapp.com/advisory/ntap-20201113-0004 · Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00391.html · Note