CVE-2019-0150 Denial of service in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers
A privileged local user can cause a denial of service in Intel Ethernet 700 Series Controllers due to insufficient access control in the firmware.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-0150?
CVE-2019-0150 is a medium-severity denial of service vulnerability in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers, published on 14 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient access control in firmware Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow a privileged user to potentially enable a denial of service via local access.
Which versions are affected by CVE-2019-0150?
It affects 7 products.
Products include Intel Ethernet 700 Series Software, Intel Ethernet Controller 710-Bm1 Firmware, Intel Ethernet Controller X710-At2 Firmware, Intel Ethernet Controller X710-Bm2 Firmware, Intel Ethernet Controller X710-Tm4 Firmware, Intel Ethernet Controller Xxv710-Am1 Firmware and 1 more.
How do I fix CVE-2019-0150?
No fix has been published for CVE-2019-0150 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-0150 being exploited?
There is no known exploitation of CVE-2019-0150 in the wild and no public exploit code.
Other vulnerabilities in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers
- CVE-2019-0140 Memory corruption in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers
- CVE-2019-0142 Privilege escalation in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers
- CVE-2019-0145 Memory corruption in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers
- CVE-2019-0139 Privilege escalation in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers
- CVE-2019-0144 Denial of service in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers
Sources
Also known as GHSA-v23f-mgg7-wchc.