Incomplete Filtering of Special Elements in Intel Trust Domain Extensions (TDX) module - CVE-2024-39283

Vulnerability identifier: #VU96066

CSH Severity: Low

CVSS v4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-39283

CWE-ID: CWE-791

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to incomplete filtering of special elements. A local administrator can gain elevated privileges on the target system.

Intel Trust Domain Extensions (TDX) module
HPE SimpliVity 380 Gen11
HPE ProLiant DL110 Gen11
HPE StoreEasy 1870 Storage
HPE StoreEasy 1870 Performance Storage
HPE StoreEasy 1670 Storage
HPE StoreEasy 1670 Performance Storage
HPE Compute Edge Server e930t
HPE Synergy 480 Gen11 Compute Module
HPE Alletra 4120
HPE Alletra 4110
HPE ProLiant ML350 Gen11 Server
HPE ProLiant ML110 Gen11
HPE ProLiant DL560 Gen11
HPE ProLiant DL380a Gen11
HPE ProLiant DL380 Gen11 Server
HPE ProLiant DL360 Gen11 Server
HPE ProLiant DL320 Gen11 Server
HPE Alletra 4140
HPE ProLiant DX4120 Gen11 server
HPE ProLiant DX560 Gen11 server
HPE ProLiant DX380 Gen11 server
HPE ProLiant DX380a Gen11 server
HPE ProLiant DX360 Gen11 server
HPE ProLiant DX320 Gen11 server

Install updates from vendor's website.

Intel Trust Domain Extensions (TDX) module - update to 1.5.01.00.592
HPE SimpliVity 380 Gen11 - update to SVTSPGen11-2024_0731
HPE ProLiant DL110 Gen11 - update to 2.10_11-28-2023
HPE StoreEasy 1870 Storage - update to 2.10_11-28-2023
HPE StoreEasy 1870 Performance Storage - update to 2.10_11-28-2023
HPE StoreEasy 1670 Storage - update to 2.10_11-28-2023
HPE StoreEasy 1670 Performance Storage - update to 2.10_11-28-2023
HPE Compute Edge Server e930t - update to 2.10_11-28-2023
HPE Synergy 480 Gen11 Compute Module - update to 2.10_11-28-2023
HPE Alletra 4120 - update to 2.10_11-28-2023
HPE Alletra 4110 - update to 2.10_11-28-2023
HPE ProLiant ML350 Gen11 Server - update to 2.10_11-28-2023
HPE ProLiant ML110 Gen11 - update to 2.10_11-28-2023
HPE ProLiant DL560 Gen11 - update to 2.10_11-28-2023
HPE ProLiant DL380a Gen11 - update to 2.10_11-28-2023
HPE ProLiant DL380 Gen11 Server - update to 2.10_11-28-2023
HPE ProLiant DL360 Gen11 Server - update to 2.10_11-28-2023
HPE ProLiant DL320 Gen11 Server - update to 2.10_11-28-2023
HPE Alletra 4140 - update to 2.16_03-01-2024
HPE ProLiant DX4120 Gen11 server - update to 2.20_05-27-2024
HPE ProLiant DX560 Gen11 server - update to 2.20_05-27-2024
HPE ProLiant DX380 Gen11 server - update to 2.20_05-27-2024
HPE ProLiant DX380a Gen11 server - update to 2.20_05-27-2024
HPE ProLiant DX360 Gen11 server - update to 2.20_05-27-2024
HPE ProLiant DX320 Gen11 server - update to 2.20_05-27-2024

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01010.html

• Privilege escalation in Intel TDX Module Software
• HPE SimpliVity servers update for Intel TDX module
• HPE ProLiant, Alletra, Synergy, and Edgeline servers update for Intel TDX module
• HPE StoreEasy servers update for Intel TDX module
• Privilege escalation in HPE ProLiant DX servers