Sign-up

ID

VAR-201905-0869


CVE

CVE-2019-0126


TITLE

Intel Multiple vulnerabilities in the product

Trust: 0.8

sources: JVNDB: JVNDB-2019-003441

DESCRIPTION

Insufficient access control in silicon reference firmware for Intel(R) Xeon(R) Scalable Processor, Intel(R) Xeon(R) Processor D Family may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access. Intel Unified Extensible Firmware Interface is prone to multiple security vulnerabilities. Attackers can leverage these issues to gain elevated privileges and execute arbitrary code to cause denial-of-service conditions on the affected device. Intel Xeon Scalable Processors are a scalable server central processing unit (CPU). Intel Xeon Processor D Family is a Xeon D series server central processing unit (CPU). The vulnerability stems from the lack of effective permissions and access control measures in network systems or products

Trust: 2.07

sources: NVD: CVE-2019-0126 // JVNDB: JVNDB-2019-004718 // BID: 108485 // VULHUB: VHN-140157 // VULMON: CVE-2019-0126

AFFECTED PRODUCTS

vendor:intelmodel:xeon gold processorsscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1513nscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1653nscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2142itscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2166ntscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1539scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1567scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1577scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2123itscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1622scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1571scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1537scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2145ntscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1623nscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1518scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1521scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1533nscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1523nscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1540scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1557scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2183itscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2191scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon bronze processorsscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon silver processorsscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2141iscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1649nscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2163itscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1559scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1602scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1527scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2161iscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2146ntscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1531scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1627scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2187ntscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1520scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon platinum processorsscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2143itscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1541scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1528scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1633nscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1637scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1543nscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2177ntscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1529scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1548scope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-2173itscope:eqversion: -

Trust: 1.0

vendor:intelmodel:xeon d-1553nscope:eqversion: -

Trust: 1.0

vendor:intelmodel:acu wizardscope: - version: -

Trust: 0.8

vendor:intelmodel:active management technologyscope: - version: -

Trust: 0.8

vendor:intelmodel:converged security management enginescope: - version: -

Trust: 0.8

vendor:intelmodel:driver and support assistantscope: - version: -

Trust: 0.8

vendor:intelmodel:dynamic application loaderscope: - version: -

Trust: 0.8

vendor:intelmodel:i915scope: - version: -

Trust: 0.8

vendor:intelmodel:nuc board nuc7i7dnbescope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kit nuc7i5dnhescope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kit nuc7i7dnhescope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kit nuc7i7dnkescope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kit nuc8i7hnkscope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kit nuc8i7hvkscope: - version: -

Trust: 0.8

vendor:intelmodel:proset/wireless software driverscope: - version: -

Trust: 0.8

vendor:intelmodel:quartus ii programmer and toolsscope: - version: -

Trust: 0.8

vendor:intelmodel:server platform servicesscope: - version: -

Trust: 0.8

vendor:intelmodel:trusted execution enginescope: - version: -

Trust: 0.8

vendor:intelmodel:intelscope: - version: -

Trust: 0.8

vendor:intelmodel:quartus primescope: - version: -

Trust: 0.8

vendor:intelmodel:scs discovery utilityscope: - version: -

Trust: 0.8

vendor:intelmodel:unite clientscope: - version: -

Trust: 0.8

vendor:intelmodel:graphics driverscope: - version: -

Trust: 0.8

vendor:intelmodel:xeon d-1602scope: - version: -

Trust: 0.8

vendor:intelmodel:xeon d-1622scope: - version: -

Trust: 0.8

vendor:intelmodel:xeon d-1623nscope: - version: -

Trust: 0.8

vendor:intelmodel:xeon d-1627scope: - version: -

Trust: 0.8

vendor:intelmodel:xeon d-1633nscope: - version: -

Trust: 0.8

vendor:intelmodel:xeon d-1637scope: - version: -

Trust: 0.8

vendor:intelmodel:xeon d-1649nscope: - version: -

Trust: 0.8

vendor:intelmodel:xeon d-1653nscope: - version: -

Trust: 0.8

vendor:intelmodel:xeon d-2141iscope: - version: -

Trust: 0.8

vendor:intelmodel:xeon d-2177ntscope: - version: -

Trust: 0.8

vendor:intelmodel:xeon scalable processorsscope:eqversion:0

Trust: 0.3

vendor:intelmodel:xeon d processorscope:eqversion:0

Trust: 0.3

vendor:intelmodel:pentium silver processor seriesscope:eqversion:0

Trust: 0.3

vendor:intelmodel:pentium processor n seriesscope:eqversion:0

Trust: 0.3

vendor:intelmodel:pentium processor j seriesscope:eqversion:0

Trust: 0.3

vendor:intelmodel:compute modulescope:eqversion:0

Trust: 0.3

vendor:intelmodel:celeron processor n seriesscope:eqversion:0

Trust: 0.3

vendor:intelmodel:celeron processor j seriesscope:eqversion:0

Trust: 0.3

vendor:intelmodel:atom processor e3900 seriesscope:eqversion:0

Trust: 0.3

vendor:intelmodel:atom processor a seriesscope:eqversion:0

Trust: 0.3

sources: BID: 108485 // JVNDB: JVNDB-2019-003441 // JVNDB: JVNDB-2019-004718 // NVD: CVE-2019-0126

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-0126
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-0126
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201905-752
value: MEDIUM

Trust: 0.6

VULHUB: VHN-140157
value: HIGH

Trust: 0.1

VULMON: CVE-2019-0126
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-0126
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-140157
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-0126
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-140157 // VULMON: CVE-2019-0126 // JVNDB: JVNDB-2019-004718 // CNNVD: CNNVD-201905-752 // NVD: CVE-2019-0126

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-264

Trust: 0.9

sources: VULHUB: VHN-140157 // JVNDB: JVNDB-2019-004718 // NVD: CVE-2019-0126

THREAT TYPE

local

Trust: 0.9

sources: BID: 108485 // CNNVD: CNNVD-201905-752

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201905-752

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-003441

PATCH
title:INTEL-SA-00234 - IntelR SCS Discovery Utility and IntelR ACU Wizard Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00234.html
Trust: 0.8
title:INTEL-SA-00244 - IntelR QuartusR Software Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00244.html
Trust: 0.8
title:INTEL-SA-00245 - Intel UniteR Client for Android* Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00245.html
Trust: 0.8
title:INTEL-SA-00204 - Intel IntelR PROSet/Wireless WiFi Software Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00204.html
Trust: 0.8
title:INTEL-SA-00249 - IntelR i915 Graphics for Linux Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00249.html
Trust: 0.8
title:INTEL-SA-00213 - IntelR CSME, IntelR SPS, IntelR TXE, IntelR DAL, and IntelR AMT 2019.1 QSR Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html
Trust: 0.8
title:INTEL-SA-00251 - IntelR NUC Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00251.html
Trust: 0.8
title:INTEL-SA-00218 - IntelR Graphics Driver for Windows* 2019.1 QSR Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00218.html
Trust: 0.8
title:INTEL-SA-00252 - IntelR Driver & Support Assistant Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00252.html
Trust: 0.8
title:INTEL-SA-00223 - Intel 2019.1 QSR UEFI Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00223.html
Trust: 0.8
title:INTEL-SA-00228 - Intel UniteR Client Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00228.html
Trust: 0.8
title:INTEL-SA-00233 - Microarchitectural Data Sampling Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
Trust: 0.8
title:INTEL-SA-00223url:https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00223.html
Trust: 0.8
title:HP: SUPPORT COMMUNICATION- SECURITY BULLETIN
HPSBHF03617 rev. 4 -  Intel UEFI System Firmware Security Updatesurl:https://vulmon.com/vendoradvisory?qidtp=hp_bulletin&qid=b0413432f47d216ea618a3e80ce26619
Trust: 0.1
title:HP: SUPPORT COMMUNICATION- SECURITY BULLETIN
HPSBHF03617 rev. 4 -  Intel UEFI System Firmware Security Updatesurl:https://vulmon.com/vendoradvisory?qidtp=hp_bulletin&qid=08e377565fb7f0ab3c26bbc2a0fc9135
Trust: 0.1
title:Threatposturl:https://threatpost.com/intel-fixes-critical-high-severity-flaws-across-several-products/144940/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2019-0126 // 
            
            
            
            JVNDB: JVNDB-2019-003441 // 
            
            
            
            JVNDB: JVNDB-2019-004718

EXTERNAL IDS
db:NVDid:CVE-2019-0126
Trust: 2.9
db:BIDid:108485
Trust: 2.1
db:JVNid:JVNVU92328381
Trust: 1.6
db:JVNDBid:JVNDB-2019-003441
Trust: 1.6
db:JVNDBid:JVNDB-2019-004718
Trust: 0.8
db:CNNVDid:CNNVD-201905-752
Trust: 0.7
db:AUSCERTid:ESB-2019.2048
Trust: 0.6
db:LENOVOid:LEN-26294
Trust: 0.6
db:CNVDid:CNVD-2020-18584
Trust: 0.1
db:VULHUBid:VHN-140157
Trust: 0.1
db:VULMONid:CVE-2019-0126
Trust: 0.1
sources:
            
            
            VULHUB: VHN-140157 // 
            
            
            
            VULMON: CVE-2019-0126 // 
            
            
            
            BID: 108485 // 
            
            
            
            JVNDB: JVNDB-2019-003441 // 
            
            
            
            JVNDB: JVNDB-2019-004718 // 
            
            
            
            CNNVD: CNNVD-201905-752 // 
            
            
            
            NVD: CVE-2019-0126

REFERENCES
url:http://www.securityfocus.com/bid/108485
Trust: 2.4
url:https://support.f5.com/csp/article/k37428370
Trust: 1.8
url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00223.html
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-0126
Trust: 1.4
url:http://www.intel.com/
Trust: 0.9
url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00218.html
Trust: 0.9
url:https://jvn.jp/vu/jvnvu92328381/index.html
Trust: 0.8
url:https://mdsattacks.com/files/ridl.pdf
Trust: 0.8
url:https://mdsattacks.com/files/fallout.pdf
Trust: 0.8
url:https://zombieloadattack.com/
Trust: 0.8
url:https://www.intel.com/content/www/us/en/architecture-and-technology/mds.html
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0126
Trust: 0.8
url:https://jvn.jp/vu/jvnvu92328381/
Trust: 0.8
url:https://jvndb.jvn.jp/ja/contents/2019/jvndb-2019-003441.html
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2019.2048/
Trust: 0.6
url:https://support.lenovo.com/us/en/product_security/len-26294
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://support.hp.com//us-en/document/c06330147
Trust: 0.1
url:https://threatpost.com/intel-fixes-critical-high-severity-flaws-across-several-products/144940/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-140157 // 
            
            
            
            VULMON: CVE-2019-0126 // 
            
            
            
            BID: 108485 // 
            
            
            
            JVNDB: JVNDB-2019-003441 // 
            
            
            
            JVNDB: JVNDB-2019-004718 // 
            
            
            
            CNNVD: CNNVD-201905-752 // 
            
            
            
            NVD: CVE-2019-0126

CREDITS
Intel
Trust: 0.9
sources:
            
            
            BID: 108485 // 
            
            
            
            CNNVD: CNNVD-201905-752

SOURCES
db:VULHUBid:VHN-140157
db:VULMONid:CVE-2019-0126
db:BIDid:108485
db:JVNDBid:JVNDB-2019-003441
db:JVNDBid:JVNDB-2019-004718
db:CNNVDid:CNNVD-201905-752
db:NVDid:CVE-2019-0126

LAST UPDATE DATE
2024-11-23T20:10:09.445000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-140157date:2020-08-24T00:00:00
db:VULMONid:CVE-2019-0126date:2021-06-21T00:00:00
db:BIDid:108485date:2019-05-14T00:00:00
db:JVNDBid:JVNDB-2019-003441date:2019-05-16T00:00:00
db:JVNDBid:JVNDB-2019-004718date:2019-06-06T00:00:00
db:CNNVDid:CNNVD-201905-752date:2020-08-25T00:00:00
db:NVDid:CVE-2019-0126date:2024-11-21T04:16:17.373

SOURCES RELEASE DATE
db:VULHUBid:VHN-140157date:2019-05-17T00:00:00
db:VULMONid:CVE-2019-0126date:2019-05-17T00:00:00
db:BIDid:108485date:2019-05-14T00:00:00
db:JVNDBid:JVNDB-2019-003441date:2019-05-16T00:00:00
db:JVNDBid:JVNDB-2019-004718date:2019-06-06T00:00:00
db:CNNVDid:CNNVD-201905-752date:2019-05-17T00:00:00
db:NVDid:CVE-2019-0126date:2019-05-17T16:29:01.923