CVE-2019-11137 Privilege escalation in 2019.2 IPU – UEFI
A privileged local attacker can exploit insufficient input validation in Intel Xeon firmware to escalate privileges, cause denial of service, or disclose information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11137?
CVE-2019-11137 is a high-severity vulnerability in 2019.2 IPU – UEFI, published on 14 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient input validation in system firmware for Intel(R) Xeon(R) Scalable Processors, Intel(R) Xeon(R) Processors D Family, Intel(R) Xeon(R) Processors E5 v4 Family, Intel(R) Xeon(R) Processors E7 v4 Family and Intel(R) Atom(R) processor C Series may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Weakness: CWE-20
Which versions are affected by CVE-2019-11137?
It affects 284 products.
Products include Hpe Apollo 4200 Gen10 Server Firmware, Hpe Apollo 4200 Gen9 Server Firmware, Hpe Proliant Bl460c Gen10 Server Blade Firmware, Hpe Proliant Bl460c Gen9 Server Blade Firmware, Hpe Proliant Bl660c Gen9 Server Firmware, Hpe Proliant Dl120 Gen10 Server Firmware and 278 more.
How do I fix CVE-2019-11137?
No fix has been published for CVE-2019-11137 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-11137 being exploited?
There is no known exploitation of CVE-2019-11137 in the wild and no public exploit code.
Other vulnerabilities in 2019.2 IPU – UEFI
Sources
Also known as GHSA-9vvw-6c33-3283.