CVE-2019-11136 Privilege escalation in 2019.2 IPU – UEFI
A privileged local user can escalate privileges, cause denial of service, or disclose information via insufficient access control in Intel Xeon system firmware.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11136?
CVE-2019-11136 is a medium-severity vulnerability in 2019.2 IPU – UEFI, published on 14 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient access control in system firmware for Intel(R) Xeon(R) Scalable Processors, 2nd Generation Intel(R) Xeon(R) Scalable Processors and Intel(R) Xeon(R) Processors D Family may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Which versions are affected by CVE-2019-11136?
It affects 284 products.
Products include Hpe Apollo 4200 Gen10 Server Firmware, Hpe Apollo 4200 Gen9 Server Firmware, Hpe Proliant Bl460c Gen10 Server Blade Firmware, Hpe Proliant Bl460c Gen9 Server Blade Firmware, Hpe Proliant Bl660c Gen9 Server Firmware, Hpe Proliant Dl120 Gen10 Server Firmware and 278 more.
How do I fix CVE-2019-11136?
No fix has been published for CVE-2019-11136 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-11136 being exploited?
There is no known exploitation of CVE-2019-11136 in the wild and no public exploit code.
Other vulnerabilities in 2019.2 IPU – UEFI
Sources
Also known as GHSA-jcc6-g3rx-46fg.