2021.1 IPU – Intel® CSME, SPS and LMS Advisory

Summary:

Potential security vulnerabilities in the Intel® Converged Security and Manageability Engine (CSME), Server Platform Services (SPS), and Intel® Local Manageability Service (Intel® LMS) may allow escalation of privilege or information disclosure.** **Intel is releasing firmware and software updates to mitigate these potential vulnerabilities.

Vulnerability Details:

CVEID: CVE-2020-24509

Description: Insufficient control flow management in subsystem in Intel® SPS versions before SPS_E3_05.01.04.300.0, SPS_SoC-A_05.00.03.091.0, SPS_E5_04.04.04.023.0, or SPS_E5_04.04.03.263.0 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 6.7 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

CVEID: CVE-2020-8704

Description: Race condition in a subsystem in the Intel® LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 6.7 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVEID: CVE-2020-24507

Description: Improper initialization in a subsystem in the Intel® CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11 and 15.0.22 may allow a privileged user to potentially enable information disclosure via local access.

CVSS Base Score: 6.0 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CVEID: CVE-2020-24516

Description: Modification of assumed-immutable data in subsystem in Intel® CSME versions before 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

CVSS Base Score: 5.3 Medium

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CVEID: CVE-2020-8703

Description: Improper buffer restrictions in a subsystem in the Intel® CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 5.1 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

CVEID: CVE-2020-24506

Description: Out of bound read in a subsystem in the Intel® CSME versions before 12.0.81, 13.0.47, 13.30.17, 14.1.53 and 14.5.32 may allow a privileged user to potentially enable information disclosure via local access.

CVSS Base Score: 4.4 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected Products:

Chipset or SOC

|

Versions before

—|—

Intel® 100 Series Chipset

|

11.8.86

7th Generation Intel® Core Processor

Intel® 100 Series Chipset

Intel® 200 Series Chipset

|

11.8.86

8th Generation Intel® Core Processor

|

11.8.86

Intel® C420 Chipset

|

11.12.86

Intel® X299 Chipset

|

11.12.86

Intel® C620 Series Chipset

|

11.22.86

Intel® 300 Series Chipset

Intel® C240 Series Chipsets

|

12.0.81

8th Generation Intel® Core Processor

Intel® Pentium® Gold Processor Series

Intel® Celeron® Processor 4000 Series

|

12.0.81

10th Generation Intel® Core Processor

|

13.0.47

Intel® 400 Series Chipset

10th Generation Intel® Core Processor

Intel® Xeon® W Processor 10000/1200 Series

|

14.1.53

Intel® Pentium® Gold Processor Series

|

14.5.32

Intel® Celeron® Processor G Series

|

14.1.53

Intel® Pentium® Silver Processor Series

Intel® Celeron® Processor N Series

|

13.50.11

Intel® Core i5 L16G7 and Core i3 L13G4

|

13.30.17

11th Generation Intel® Core Processor

Intel® Pentium® Gold Processor Series

Intel® Celeron® Processor 6000 Series

|

15.0.22

Intel® C240 Series Chipset

|

SPS_E3_05.01.04.300.0

Intel Atom® Processor P5000 Series

|

SPS_SoC-A_05.00.03.091.0

3rd Generation Intel® Xeon® Scalable Processor

Intel® C620A Series Chipset

|

SPS_E5_04.04.04.023.0

3rd Generation Intel® Xeon® Scalable Processor

Intel® C620A Series Chipset

|

SPS_E5_04.04.03.263.0

Note: Firmware versions of Intel® ME 3.x thru 10.x, Intel® TXE 1.x thru 2.x, and Intel® Server Platform Services 1.x thru 2.X are no longer supported versions. There is no new general release planned for these versions.

Recommendations:

Intel recommends that users of Intel® CSME, SPS and Intel® LMS update to the latest version provided by the system manufacturer that addresses these issues.

Acknowledgements:

These issues were found internally by Intel employees. Intel would like to thank Julien Lenoir, Marek Augoff-Birman, Yaakov Cohen, Yael Ben Ami, Yocheved Butterman and Yossef Kuszer.****

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.