Vulnerability CVE-2019-11184


Published: 2019-09-16

Description:
A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial information disclosure via adjacent access.

Type:

CWE-362

Vendor: Intel
Product: 4116t firmware 
Product: E5-2637 firmware 
Product: E5-4669 firmware 
Product: 3106 firmware 
Product: E5-2620 firmware 
Product: E5-4650 firmware 
Product: E5-2470 firmware 
Product: E5-4610 firmware 
Product: E7-8880l firmware 
Product: E5-2430 firmware 
Product: E5-2698 firmware 
Product: E7-4890 firmware 
Product: E5-1660 firmware 
Product: E5-2687w firmware 
Product: E7-4830 firmware 
Product: 6130t firmware 
Product: E5-2660 firmware 
Product: E7-2870 firmware 
Product: 5119t firmware 
Product: E5-2643 firmware 
Product: 4110 firmware 
Product: E5-2628l firmware 
Product: E5-4657l firmware 
Product: E5-2608l firmware 
Product: E5-4627 firmware 
Product: E7-8891 firmware 
Product: E5-2440 firmware 
Product: E5-2699a firmware 
Product: E7-8857 firmware 
Product: E5-2403 firmware 
Product: E5-2695 firmware 
Product: E7-4860 firmware 
Product: E5-1620 firmware 
Product: E5-2670 firmware 
Product: E7-2890 firmware 
Product: 6126 firmware 
Product: E5-2650 firmware 
Product: 4116 firmware 
Product: E5-2630l firmware 
Product: E5-4667 firmware 
Product: E5-2618l firmware 
Product: E5-4640 firmware 
Product: E7-8895 firmware 
Product: E5-2450l firmware 
Product: E5-4607 firmware 
Product: E7-8880 firmware 
Product: E5-2420 firmware 
Product: E5-2697a firmware 
Product: E7-4880 firmware 
Product: E5-1650 firmware 
Product: E5-2683 firmware 
Product: E7-4820 firmware 
Product: 6130 firmware 
Product: E5-2658 firmware 
Product: 5118 firmware 
Product: E5-2640 firmware 
Product: E7-2850 firmware 
Product: 4109t firmware 
Product: E5-2623 firmware 
Product: E5-4655 firmware 
Product: E5-2603 firmware 
Product: E5-4620 firmware 
Product: E7-8890 firmware 
Product: E5-2430l firmware 
Product: E5-2699 firmware 
Product: E7-8850 firmware 
Product: E5-1680 firmware 
Product: E5-2690 firmware 
Product: E7-4850 firmware 
Product: 6138 firmware 
Product: E5-2667 firmware 
Product: E7-2880 firmware 
Product: 5120t firmware 
Product: E5-2648l firmware 
Product: 4114t firmware 
Product: E5-2630 firmware 
Product: E5-4660 firmware 
Product: E5-2609 firmware 
Product: E5-4628l firmware 
Product: E7-8893 firmware 
Product: E5-2450 firmware 
Product: E5-4603 firmware 
Product: E7-8870 firmware 
Product: E5-2407 firmware 
Product: E5-2697 firmware 
Product: E7-4870 firmware 
Product: E5-1630 firmware 
Product: E5-2680 firmware 
Product: E7-4809 firmware 
Product: 6126t firmware 
Product: E5-2650l firmware 

CVSS2 => (AV:A/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.9/10
2.9/10
5.5/10
Exploit range
Attack complexity
Authentication
Adjacent network
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
https://arxiv.org/abs/1909.04841
https://support.f5.com/csp/article/K43220413
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00290.html

Related CVE
CVE-2019-11166
Improper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1.0731 may allow an authenticated user to potentially enable escalation of privilege via local attack.
CVE-2019-11163
Insufficient access control in a hardware abstraction driver for Intel(R) Processor Identification Utility for Windows before version 6.1.0731 may allow an authenticated user to potentially enable escalation of privilege, denial of service or informa...
CVE-2019-11148
Improper permissions in the installer for Intel(R) Remote Displays SDK before version 2.0.1 R2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2019-11143
Improper permissions in the software installer for Intel(R) Authenticate before 3.8 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2019-11140
Insufficient session validation in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-0173
Authentication bypass in the web console for Intel(R) Raid Web Console 2 all versions may allow an unauthenticated attacker to potentially enable disclosure of information via network access.
CVE-2019-11129
Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-11128
Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.

Copyright 2019, cxsecurity.com

 

Back to Top