HPESBHF04150 rev.1 - HPE Gen10 Servers with Certain Intel Processors, Multiple Local Vulnerabilities

Document Subtype: Security Bulletin|Document ID: hpesbhf04150en_us|Last Updated: 2021-06-09|Release Date: 2021-06-08|Document Version: 1

Potential Security Impact: Local: Denial of Service (DoS), Disclosure of Information, Escalation of Privilege

Source: Hewlett Packard Enterprise, HPE Product Security Response Team

VULNERABILITY SUMMARY

Security vulnerabilities in the BIOS firmware of certain Intel processors in certain Gen10 HPE servers may allow disclosure of information, escalation of privilege, or denial of service. HPE is releasing firmware updates to mitigate these vulnerabilities.

For more information on these vulnerabilities please refer to the following Intel SAs:

Intel Security Advisory INTEL-SA-00464
Intel-Security Advisory INTEL-SA-00463

References:

CVE-2020-24511 - Disclosure of information, INTEL-SA-00464
CVE-2020-12358 - Denial of Service, INTEL-SA-00463
CVE-2020-12360 - Escalation of Privilege INTEL-SA-00463
CVE-2020-24486 - Denial of Service, INTEL-SA-00463

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

HPE ProLiant DL360 Gen10 Server - Prior to version 2.50
HPE ProLiant DL380 Gen10 Server - Prior to version 2.50
HPE ProLiant DL120 Gen10 Server - Prior to version 2.50
HPE ProLiant DL160 Gen10 Server - Prior to version 2.50
HPE ProLiant DL180 Gen10 Server - Prior to version 2.50
HPE ProLiant DL560 Gen10 Server - Prior to version 2.50
HPE ProLiant DL580 Gen10 Server - Prior to version 2.50
HPE ProLiant ML110 Gen10 Server - Prior to version 2.50
HPE ProLiant XL230k Gen10 Server - Prior to version 2.50
HPE ProLiant XL170r Gen10 Server - Prior to version 2.50
HPE ProLiant XL450 Gen10 Server - Prior to version 2.50
HPE ProLiant XL270d Gen10 Server - Prior to version 2.50
HPE ProLiant BL460c Gen10 Server Blade - Prior to version 2.50
HPE ProLiant XL190r Gen10 Server - Prior to version 2.50
HPE ProLiant ML350 Gen10 Server - Prior to version 2.50

BACKGROUND

HPE calculates CVSS using CVSS Version 3.1. If the score is provided from NIST, we will display Version 2.0, 3.0, or 3.1 as provided from NVD.

Reference	V3 Vector	V3 Base Score	V2 Vector	V2 Base Score
CVE-2020-12358	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H	6.7	(AV:L/AC:L/Au:M/C:P/I:N/A:C)	5.0
CVE-2020-12360	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N	5.6	(AV:L/AC:H/Au:S/C:C/I:N/A:N)	3.8
CVE-2020-24486	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	5.5	(AV:L/AC:L/Au:S/C:N/I:N/A:C)	4.6
CVE-2020-24511	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N	5.6	(AV:L/AC:H/Au:S/C:C/I:N/A:N)	3.8

Information on CVSS is documented in HPE Customer Notice: HPSN-2008-002

RESOLUTION

HPE is providing updated firmware to mitigate these vulnerabilities in Gen10 servers with affected Intel processors.

Please visit HPE Support Center to obtain firmware updates for your products.

HISTORY
Version:1 (rev.1) - 8 June 2021 Initial release

Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy.

Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.

Report: To report a potential security vulnerability for any HPE supported product:

Web Form: https://www.hpe.com/info/report-security-vulnerability
Email: security-alert@hpe.com
Hewlett Packard Enterprise Product Security Response Policy: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00100637en_us

Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice

Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive

Hewlett Packard Enterprise Development shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HPE nor its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise Development and the names of Hewlett Packard Enterprise Development products referenced herein are trademarks of Hewlett Packard Enterprise Development in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.

CVSS Severity from NVD

High

	Critical	0
	High	1
	Medium	3
	Low	0

View CVE details