CVE-2020-7135 : What You Need to Know
Learn about CVE-2020-7135, a security vulnerability in HPE disk drive firmware installers affecting HPE Service Pack for ProLiant and various hard drives. Find out the impact, affected systems, and mitigation steps.
A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerability affects various HPE products including HPE Service Pack for ProLiant and different types of hard drives.
Understanding CVE-2020-7135
This CVE identifies a security issue in the disk drive firmware installers on HPE servers running Linux.
What is CVE-2020-7135?
The vulnerability exists in the Supplemental Update / Online ROM Flash Component for Linux (x64) software included in HPE Service Pack for ProLiant releases 2018.06.0, 2018.09.0, and 2018.11.0. It could be exploited locally to execute arbitrary code.
The Impact of CVE-2020-7135
The vulnerability allows for local execution of arbitrary code with privilege elevation, posing a significant security risk to affected systems.
Technical Details of CVE-2020-7135
This section provides more technical insights into the vulnerability.
Vulnerability Description
The installer in the Supplemental Update / Online ROM Flash Component for Linux (x64) software can be locally exploited to execute arbitrary code.
Affected Systems and Versions
- HPE Service Pack for ProLiant versions 2018.06.0, 2018.09.0, and 2018.11.0
- HPE Server Solid State Drives (HPG2)
- HPE Server SAS Hard Drives (HPG2)
- HPE Server SATA Hard Drives (HPG2)
- HPE SATA Read Intensive Solid State Drives (HPG2)
- HPE NVMe Mixed Use Solid State Drives (HPG2)
- HPE Business Critical Hard Drives (HPG2)
- HPE Server Enterprise Hard Drives (HPG2)
Exploitation Mechanism
The vulnerability can be exploited locally to execute arbitrary code with privilege elevation.
Mitigation and Prevention
It is crucial to take immediate steps to address and prevent the exploitation of this vulnerability.
Immediate Steps to Take
- Apply the 2019_03 SPP and Supplemental Update / Online ROM Flash Component for Linux (x64) after 2019.03.0 to fix the issue.
Long-Term Security Practices
- Regularly update firmware and software to patch known vulnerabilities.
- Implement strong access controls and monitoring mechanisms to prevent unauthorized access.
Patching and Updates
- Ensure all HPE servers running Linux are updated with the latest firmware and software patches to mitigate the vulnerability.