CVE-2019-9836 Weak cryptography in n/a
Insecure cryptographic implementation in AMD PSP firmware allows bypassing Secure Encrypted Virtualization protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-9836?
CVE-2019-9836 is a medium-severity vulnerability in Opensuse Leap, published on 25 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation.
Weakness: CWE-327
Which versions are affected by CVE-2019-9836?
It affects 2 products.
Linux distribution packages (7)
kernel-firmware SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 20190618-5.8.1 |
kernel-firmware SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 20190618-3.22.1 |
kernel-firmware SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 20190618-3.3.1 |
kernel-firmware SUSE:Linux Enterprise Server 12 SP4 | All versions | 20190618-5.8.1 |
kernel-firmware SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 20190618-5.8.1 |
kernel-firmware openSUSE:Leap 15.0 | All versions | 20190618-lp151.2.6.1 |
kernel-firmware openSUSE:Leap 15.1 | All versions | 20190618-lp151.2.6.1 |
Products include Amd Secure Encrypted Virtualization Firmware, Opensuse Leap.
How do I fix CVE-2019-9836?
Apply the vendor's patch.
Is CVE-2019-9836 being exploited?
There is no known exploitation of CVE-2019-9836 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-9836, GHSA-mmcw-j5qf-fj6c, MGASA-2019-0207, SUSE-SU-2019:1792-1, SUSE-SU-2019:1802-1, SUSE-SU-2019:1803-1 and 1 more.