CVE-2019-0120 Information disclosure in Intel(R) Unified Extensible Firmware Interface (UEFI)
A privileged local attacker can cause a denial of service due to insufficient key protection in Intel UEFI firmware.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-0120?
CVE-2019-0120 is a medium-severity vulnerability in Intel(R) Unified Extensible Firmware Interface (UEFI), published on 17 May 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient key protection vulnerability in silicon reference firmware for Intel(R) Pentium(R) Processor J Series, Intel(R) Pentium(R) Processor N Series, Intel(R) Celeron(R) J Series, Intel(R) Celeron(R) N Series, Intel(R) Atom(R) Processor A Series, Intel(R) Atom(R) Processor E3900 Series, Intel(R) Pentium(R) Processor Silver Series may allow a privileged user to potentially enable denial of service via local access.
Weakness: CWE-522
Which versions are affected by CVE-2019-0120?
It affects 28 products.
Products include Intel Atom 230 Firmware, Intel Atom 330 Firmware, Intel Atom X5-E3930 Firmware, Intel Atom X5-E3940 Firmware, Intel Atom X7-E3950 Firmware, Intel Celeron J3060 Firmware and 22 more.
How do I fix CVE-2019-0120?
No fix has been published for CVE-2019-0120 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-0120 being exploited?
There is no known exploitation of CVE-2019-0120 in the wild and no public exploit code.
Other vulnerabilities in Intel(R) Unified Extensible Firmware Interface (UEFI)
Sources
Also known as GHSA-c89g-ghqx-95xg.