CVE-2020-0539 Path traversal in Intel(R) AMT and Intel(R) CSME

What is CVE-2020-0539?

CVE-2020-0539 is a medium-severity path traversal vulnerability in Intel(R) AMT and Intel(R) CSME, published on 15 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Path traversal in subsystem for Intel(R) DAL software for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 and Intel(R) TXE versions before 3.1.75, 4.0.25 may allow an unprivileged user to potentially enable denial of service via local access.

Weakness: CWE-22

Which versions are affected by CVE-2020-0539?

It affects 2 products.

Products include Intel Converged Security Management Engine Firmware, Intel Trusted Execution Engine Firmware.

How do I fix CVE-2020-0539?

No fix has been published for CVE-2020-0539 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-0539 being exploited?

There is no known exploitation of CVE-2020-0539 in the wild and no public exploit code.

Other vulnerabilities in Intel(R) AMT and Intel(R) CSME

• CVE-2019-0153 Memory corruption in Intel(R) Converged Security & Management Engine (CSME) Critical 9.8
• CVE-2019-0169 Memory corruption in Intel(R) TXE High 8.8
• CVE-2022-36392 Denial of service in Intel(R) AMT and Intel(R) Standard Manageability in Intel (R) CSME High 8.6
• CVE-2018-3643 Information disclosure in Intel(R) Converged Security and Management Engine (CSME) and Intel(R) Server Platform Services firmware High 8.2
• CVE-2018-3627 Privilege escalation in Intel Converged Security Management Engine (Intel CSME) High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x98q-xj22-fqcf.