SUPPORT COMMUNICATION- SECURITY BULLETIN HPSBHF03667 rev. 2 - Intel® 2020.1 IPU - CSME, SPS, TXT, AMT and DAL Security Updates

Escalation of Privilege, Denial of Service, Information Disclosure.

Source: HP, HP Product Security Response Team (PSRT)

Reported By: Intel®

HP has been notified by Intel of potential security vulnerabilities in the Intel® Converged Security and Manageability Engine (CSME), Server Platform Services (SPS), Intel® Trusted Execution Engine (TXE), Intel® Active Management Technology (AMT) and Intel® Dynamic Application Loader (DAL) may allow escalation of privilege, denial of service or information disclosure.

INTEL-SA-00295 (in English): CVE-2020-0531, CVE-2020-0532, CVE-2020-0533, CVE-2020-0534, CVE-2020-0535, CVE-2020-0536, CVE-2020-0537, CVE-2020-0538, CVE-2020-0539 , CVE-2020-0540, CVE-2020-0541, CVE -2020-0542, CVE-2020-0545, CVE-2020-0566, CVE-2020-0586, CVE-2020-0594, CVE-2020-0595, CVE-2020-0596, CVE-2020-0597, CVE-2020-8674, PSR-2020-0095

See RESOLUTION Section.

For a PGP signed version of this security bulletin please write to: hp-security-alert@hp.com

CVSS 3.1 Base Metrics

CVE-2020-0594, CVE-2020-0595, CVE-2020-0596 and CVE-2020-0597 only apply if Intel® AMT is provisioned and if Intel® AMT is configured with IPv6.

Intel has released updates to mitigate the potential vulnerabilities. HP has identified the affected platforms and corresponding SoftPaqs with minimum versions that mitigate the potential vulnerabilities. See the affected platforms listed below.

Newer versions may become available and identified minimum versions may become obsolete. If a SoftPaq Link becomes invalid, check the HP Customer Support - Software and Driver Downloads site to obtain the latest update for your product model.

HP recommends keeping your system up to date with the latest firmware and software.

note:

This bulletin might be updated when new information and/or SoftPaqs are available. Sign up for HP Subscriptions to be notified and receive:

• Product support eAlerts
• Driver updates
• Security bulletin updates

Pending: SoftPaq is in progress.

Under investigation: System under investigation for impact, or SoftPaq under investigation for feasibility/availability.

Not available: SoftPaq not available due to technical or logistical constraints.

Check support page: The listed SoftPaq has been removed from download site. SoftPaqs with newer versions may be available on the HP Customer Support - Software and Driver Downloads site.