Skip to main content
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.

Article Number: 000129567


DSA-2019-166: Dell EMC Server Platform Security Advisory for Intel Platform Updates (2019.2)

Summary: Dell EMC Server Platform Intel Platform Updates (2019.2) to address multiple vulnerabilities which may potentially be exploited to compromise the system.

Article Content


Impact

High

Details

 

Updates are available to address the following security vulnerabilities.

Intel-SA-00241Intel CSME, Server Platform Services, Trusted Execution Engine, Intel Active Management Technology:
  • CVE-2019-11090, CVE-2019-11109

Intel-SA-00220Intel Trusted Execution Technology (TXT)
Intel-SA-00240
  • CVE-2019-0124, CVE-2019-0151

Intel-SA-00220Intel Software Guard Extensions (SGX)
  • CVE-2019-0123

Intel-SA-00240: Intel UEFI BIOS
Intel-SA-00280
  • CVE-2019-0152, CVE-2019-11136, CVE-2019-11137

Intel-SA-00270TSX Asynchronous Abort (TAA)
  • CVE-2019-11135

Intel-SA-00271Voltage Modulation
  • CVE-2019-11139

Customers should also review their OS vendor’s Security Advisory for information, to ensure appropriate vulnerability identification and patch/configuration measures to be used in conjunction with the updates provided by Dell for the most effective mitigation.

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm. To search for a particular CVE, use the database’s search utility at http://web.nvd.nist.gov/view/vuln/search.
Updates are available to address the following security vulnerabilities.

Intel-SA-00241Intel CSME, Server Platform Services, Trusted Execution Engine, Intel Active Management Technology:
  • CVE-2019-11090, CVE-2019-11109

Intel-SA-00220Intel Trusted Execution Technology (TXT)
Intel-SA-00240
  • CVE-2019-0124, CVE-2019-0151

Intel-SA-00220Intel Software Guard Extensions (SGX)
  • CVE-2019-0123

Intel-SA-00240: Intel UEFI BIOS
Intel-SA-00280
  • CVE-2019-0152, CVE-2019-11136, CVE-2019-11137

Intel-SA-00270TSX Asynchronous Abort (TAA)
  • CVE-2019-11135

Intel-SA-00271Voltage Modulation
  • CVE-2019-11139

Customers should also review their OS vendor’s Security Advisory for information, to ensure appropriate vulnerability identification and patch/configuration measures to be used in conjunction with the updates provided by Dell for the most effective mitigation.

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm. To search for a particular CVE, use the database’s search utility at http://web.nvd.nist.gov/view/vuln/search.
Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Affected Products and Remediation

The following is a list of impacted products and expected release dates. Dell recommends all customers update at the earliest opportunity.

We encourage customers to review Intel’s Security Advisory for information, including appropriate identification and mitigation measures.

Visit the Drivers and Downloads site for updates on the applicable products. Note, the following list of impacted products with released BIOS updates are linked. To learn more, visit the Dell Knowledge Base article Update a Dell PowerEdge Driver or Firmware Directly from the OS (Windows and Linux), and download the update for your Dell computer.

Customers may use one of the Dell notification solutions (How to Subscribe to receive Dell Driver and Firmware Update notifications) to be notified and download driver, BIOS and firmware updates automatically once available.

 

SLN319434_en_US__1icon ***NOTE: BIOS version 2.4.7 is removed from the web for a non security related BIOS update issue associated with certain hardware configurations. BIOS 2.4.8 is web posted. Refer to the BIOS version 2.4.8 release notes for more information.

Servers that already have BIOS version 2.4.7 installed successfully do not need to take any immediate action. We do recommend installing BIOS 2.4.8 when it becomes available.

Briefly describe the symptoms of the issue.
DSA ID: DSA-2019-166

CVE Identifier: CVE-2019-11090, CVE-2019-11109, CVE-2019-0124, CVE-2019-0151, CVE-2019-0123, CVE-2019-0152, CVE-2019-11136, CVE-2019-11137, CVE-2019-11135, CVE-2019-11139

Severity: High

Severity Rating: CVSSv3 Base Score: See NVD (http://nvd.nist.gov/) for individual scores for each CVE
                         
Affected products:
 Dell EMC Servers (see Resolution section below for complete list of affected products)

Summary:  
Dell EMC Servers require a security update to address vulnerabilities in Intel Server Platform Services, Software Guard Extensions, Trusted Execution Technology, UEFI BIOS, TSX and Voltage Modulation.

Details:  
Updates are available to address the following security vulnerabilities.

Intel-SA-00241: Intel CSME, Server Platform Services, Trusted Execution Engine, Intel Active Management Technology:
  • CVE-2019-11090, CVE-2019-11109

Intel-SA-00220: Intel Trusted Execution Technology (TXT)
Intel-SA-00240
  • CVE-2019-0124, CVE-2019-0151

Intel-SA-00220: Intel Software Guard Extensions (SGX)
  • CVE-2019-0123

Intel-SA-00240: Intel UEFI BIOS
Intel-SA-00280
  • CVE-2019-0152, CVE-2019-11136, CVE-2019-11137

Intel-SA-00270: TSX Asynchronous Abort (TAA)
  • CVE-2019-11135

Intel-SA-00271: Voltage Modulation
  • CVE-2019-11139

Customers should also review their OS vendor’s Security Advisory for information, to ensure appropriate vulnerability identification and patch/configuration measures to be used in conjunction with the updates provided by Dell for the most effective mitigation.

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm. To search for a particular CVE, use the database’s search utility at http://web.nvd.nist.gov/view/vuln/search.

Resolution:  
The following is a list of impacted products and expected release dates. Dell recommends all customers update at the earliest opportunity.

We encourage customers to review Intel’s Security Advisory for information, including appropriate identification and mitigation measures.

Visit the Drivers and Downloads site for updates on the applicable products. Note, the following list of impacted products with released BIOS updates are linked. To learn more, visit the Dell Knowledge Base article Update a Dell PowerEdge Driver or Firmware Directly from the OS (Windows and Linux), and download the update for your Dell computer.

Customers may use one of the Dell notification solutions (How to Subscribe to receive Dell Driver and Firmware Update notifications) to be notified and download driver, BIOS and firmware updates automatically once available. 
SLN319434_en_US__1icon ***NOTE: BIOS version 2.4.7 is removed from the web for a non security related BIOS update issue associated with certain hardware configurations. BIOS 2.4.8 is web posted. Refer to the BIOS version 2.4.8 release notes for more information.

Servers that already have BIOS version 2.4.7 installed successfully do not need to take any immediate action. We do recommend installing BIOS 2.4.8 when it becomes available.
 
Dell EMC Server Products Affected
 
Product BIOS Update Version
(or greater)
Release Date/
Expected Release Date
(MM/DD/YYYY)
R640R740R740XDR940NX3240NX3340 2.4.8*** 12/02/2019
XC740XDXC640XC940    
R540R440T440XR2 2.4.8*** 12/02/2019
R740XD2 2.4.8*** 12/02/2019
R840R940xa 2.4.7 11/12/2019
T640 2.4.7 11/12/2019
C6420XC6420 2.4.8*** 12/02/2019
FC640M640M640P 2.4.8*** 12/02/2019
MX740C 2.4.8*** 12/02/2019
MX840C 2.4.8*** 12/02/2019
C4140 2.4.8*** 12/02/2019
T140T340R240R340NX440 2.1.6 11/12/2019
DSS9600DSS9620DS9630 2.4.8 12/16/2019
 
R830 1.11.0 02/04/2020
T130R230T330R330NX430 2.8.1 01/10/2020
R930 2.8.1 02/12/2020
R730R730XDR630 2.11.0 12/20/2019
NX3330, NX3230, DSMS630, DSMS730    
XC730XC703XDXC630 2.11.0 12/20/2019
C4130 2.11.0 12/20/2019
M630M630PFC630 2.11.0 01/09/2020
FC430  2.11.0 12/20/2019
M830M830PFC830 2.11.0 01/06/2020
T630 2.11.0 01/17/2020
R530R430T430 2.11.0  01/10/2020
XC430, XC430Xpress    
C6320 2.11.0   02/04/2020
XC6320 2.11.0   02/04/2020
T30 1.1.1 01/14/2020 
DSS1500, DSS1510, DSS2500    
DSS7500    
 
R920   Mar 2020
R820   Mar 2020
R520   Mar 2020
R420   Mar 2020
R320, NX400   Mar 2020
T420   Mar 2020
T320   Mar 2020
R220   Mar 2020
R720R720XD, NX3200, XC720XD 2.9.0  01/09/2020
R620, NX3300 2.9.0  01/09/2020
M820   Mar 2020
M620   Mar 2020
M520   Mar 2020
M420   Mar 2020
T620   Mar 2020
C5230   Mar 2020
C6220   Mar 2020
C6220II   Mar 2020
C8220, C8220X   Mar 2020
The following is a list of impacted products and expected release dates. Dell recommends all customers update at the earliest opportunity.

We encourage customers to review Intel’s Security Advisory for information, including appropriate identification and mitigation measures.

Visit the Drivers and Downloads site for updates on the applicable products. Note, the following list of impacted products with released BIOS updates are linked. To learn more, visit the Dell Knowledge Base article Update a Dell PowerEdge Driver or Firmware Directly from the OS (Windows and Linux), and download the update for your Dell computer.

Customers may use one of the Dell notification solutions (How to Subscribe to receive Dell Driver and Firmware Update notifications) to be notified and download driver, BIOS and firmware updates automatically once available.

 

SLN319434_en_US__1icon ***NOTE: BIOS version 2.4.7 is removed from the web for a non security related BIOS update issue associated with certain hardware configurations. BIOS 2.4.8 is web posted. Refer to the BIOS version 2.4.8 release notes for more information.

Servers that already have BIOS version 2.4.7 installed successfully do not need to take any immediate action. We do recommend installing BIOS 2.4.8 when it becomes available.

Briefly describe the symptoms of the issue.
DSA ID: DSA-2019-166

CVE Identifier: CVE-2019-11090, CVE-2019-11109, CVE-2019-0124, CVE-2019-0151, CVE-2019-0123, CVE-2019-0152, CVE-2019-11136, CVE-2019-11137, CVE-2019-11135, CVE-2019-11139

Severity: High

Severity Rating: CVSSv3 Base Score: See NVD (http://nvd.nist.gov/) for individual scores for each CVE
                         
Affected products:
 Dell EMC Servers (see Resolution section below for complete list of affected products)

Summary:  
Dell EMC Servers require a security update to address vulnerabilities in Intel Server Platform Services, Software Guard Extensions, Trusted Execution Technology, UEFI BIOS, TSX and Voltage Modulation.

Details:  
Updates are available to address the following security vulnerabilities.

Intel-SA-00241: Intel CSME, Server Platform Services, Trusted Execution Engine, Intel Active Management Technology:
  • CVE-2019-11090, CVE-2019-11109

Intel-SA-00220: Intel Trusted Execution Technology (TXT)
Intel-SA-00240
  • CVE-2019-0124, CVE-2019-0151

Intel-SA-00220: Intel Software Guard Extensions (SGX)
  • CVE-2019-0123

Intel-SA-00240: Intel UEFI BIOS
Intel-SA-00280
  • CVE-2019-0152, CVE-2019-11136, CVE-2019-11137

Intel-SA-00270: TSX Asynchronous Abort (TAA)
  • CVE-2019-11135

Intel-SA-00271: Voltage Modulation
  • CVE-2019-11139

Customers should also review their OS vendor’s Security Advisory for information, to ensure appropriate vulnerability identification and patch/configuration measures to be used in conjunction with the updates provided by Dell for the most effective mitigation.

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm. To search for a particular CVE, use the database’s search utility at http://web.nvd.nist.gov/view/vuln/search.

Resolution:  
The following is a list of impacted products and expected release dates. Dell recommends all customers update at the earliest opportunity.

We encourage customers to review Intel’s Security Advisory for information, including appropriate identification and mitigation measures.

Visit the Drivers and Downloads site for updates on the applicable products. Note, the following list of impacted products with released BIOS updates are linked. To learn more, visit the Dell Knowledge Base article Update a Dell PowerEdge Driver or Firmware Directly from the OS (Windows and Linux), and download the update for your Dell computer.

Customers may use one of the Dell notification solutions (How to Subscribe to receive Dell Driver and Firmware Update notifications) to be notified and download driver, BIOS and firmware updates automatically once available. 
SLN319434_en_US__1icon ***NOTE: BIOS version 2.4.7 is removed from the web for a non security related BIOS update issue associated with certain hardware configurations. BIOS 2.4.8 is web posted. Refer to the BIOS version 2.4.8 release notes for more information.

Servers that already have BIOS version 2.4.7 installed successfully do not need to take any immediate action. We do recommend installing BIOS 2.4.8 when it becomes available.
 
Dell EMC Server Products Affected
 
Product BIOS Update Version
(or greater)
Release Date/
Expected Release Date
(MM/DD/YYYY)
R640R740R740XDR940NX3240NX3340 2.4.8*** 12/02/2019
XC740XDXC640XC940    
R540R440T440XR2 2.4.8*** 12/02/2019
R740XD2 2.4.8*** 12/02/2019
R840R940xa 2.4.7 11/12/2019
T640 2.4.7 11/12/2019
C6420XC6420 2.4.8*** 12/02/2019
FC640M640M640P 2.4.8*** 12/02/2019
MX740C 2.4.8*** 12/02/2019
MX840C 2.4.8*** 12/02/2019
C4140 2.4.8*** 12/02/2019
T140T340R240R340NX440 2.1.6 11/12/2019
DSS9600DSS9620DS9630 2.4.8 12/16/2019
 
R830 1.11.0 02/04/2020
T130R230T330R330NX430 2.8.1 01/10/2020
R930 2.8.1 02/12/2020
R730R730XDR630 2.11.0 12/20/2019
NX3330, NX3230, DSMS630, DSMS730    
XC730XC703XDXC630 2.11.0 12/20/2019
C4130 2.11.0 12/20/2019
M630M630PFC630 2.11.0 01/09/2020
FC430  2.11.0 12/20/2019
M830M830PFC830 2.11.0 01/06/2020
T630 2.11.0 01/17/2020
R530R430T430 2.11.0  01/10/2020
XC430, XC430Xpress    
C6320 2.11.0   02/04/2020
XC6320 2.11.0   02/04/2020
T30 1.1.1 01/14/2020 
DSS1500, DSS1510, DSS2500    
DSS7500    
 
R920   Mar 2020
R820   Mar 2020
R520   Mar 2020
R420   Mar 2020
R320, NX400   Mar 2020
T420   Mar 2020
T320   Mar 2020
R220   Mar 2020
R720R720XD, NX3200, XC720XD 2.9.0  01/09/2020
R620, NX3300 2.9.0  01/09/2020
M820   Mar 2020
M620   Mar 2020
M520   Mar 2020
M420   Mar 2020
T620   Mar 2020
C5230   Mar 2020
C6220   Mar 2020
C6220II   Mar 2020
C8220, C8220X   Mar 2020
 

Workarounds and Mitigations

 

Acknowledgements

  

Revision History

  

Related Information


Article Properties


Affected Product

Hyper-converged Systems, Datacenter Scalable Solutions, PowerEdge

Product

Product Security Information

Last Published Date

22 May 2021

Article Type

Dell Security Advisory