CVE-2019-0142 Privilege escalation in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers

What is CVE-2019-0142?

CVE-2019-0142 is a high-severity vulnerability in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers, published on 14 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Insufficient access control in ilp60x64.sys driver for Intel(R) Ethernet 700 Series Controllers before version 1.33.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.

Which versions are affected by CVE-2019-0142?

It affects 7 products.

Products include Intel Ethernet 700 Series Software, Intel Ethernet Controller 710-Bm1 Firmware, Intel Ethernet Controller X710-At2 Firmware, Intel Ethernet Controller X710-Bm2 Firmware, Intel Ethernet Controller X710-Tm4 Firmware, Intel Ethernet Controller Xxv710-Am1 Firmware and 1 more.

How do I fix CVE-2019-0142?

No fix has been published for CVE-2019-0142 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-0142 being exploited?

There is no known exploitation of CVE-2019-0142 in the wild and no public exploit code.

Other vulnerabilities in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers

• CVE-2019-0140 Memory corruption in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers High 8.8
• CVE-2019-0145 Memory corruption in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers High 7.8
• CVE-2019-0139 Privilege escalation in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers Medium 6.7
• CVE-2019-0144 Denial of service in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers Medium 6.5
• CVE-2019-0143 Denial of service in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2vjr-3244-hj86.