CVE-2019-0154 Missing authorization in 2019.2 IPU – Intel(R) Processor Graphics Update

What is CVE-2019-0154?

CVE-2019-0154 is a medium-severity missing authorization vulnerability in Canonical Ubuntu Linux, published on 14 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may allow an authenticated user to potentially enable denial of service via local access.

Which versions are affected by CVE-2019-0154?

It affects 148 products.

Products include Canonical Ubuntu Linux, Intel Atom X5-A3930 Firmware, Intel Atom X5-A3940 Firmware, Intel Atom X7-A3950 Firmware, Intel Celeron J3355 Firmware, Intel Celeron J3455 Firmware and 142 more.

How do I fix CVE-2019-0154?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-0154 being exploited?

There is no known exploitation of CVE-2019-0154 in the wild and no public exploit code.

Other vulnerabilities in Canonical Ubuntu Linux

• CVE-2020-11651 SaltStack Salt Authentication Bypass Exploited Critical 9.8
• CVE-2020-7247 OpenSMTPD Remote Code Execution Exploited Critical 9.8
• CVE-2019-16928 Exim Out-of-bounds Write Exploited Critical 9.8
• CVE-2018-6789 Exim Buffer Overflow Exploited Critical 9.8
• CVE-2015-2590 Oracle Java SE and Java SE Embedded Remote Code Execution Exploited Critical 9.8

All Canonical Ubuntu Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-0154, GHSA-wxww-q7fc-j26f, UBUNTU-CVE-2019-0154.