Strix
26.1K

CVE-2019-11137

HIGHCVSS 8.2/10EPSS 0.39%

Last modified

CVE-2019-11137 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. Insufficient input validation in system firmware for Intel(R) Xeon(R) Scalable Processors, Intel(R) Xeon(R) Processors D Family, Intel(R) Xeon(R) Processors E5 v4 Family, Intel(R) Xeon(R) Processors E7 v4 Family and Intel(R) Atom(R) processor C Series may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.. EPSS estimates a 0.39% chance of exploitation in the next 30 days.

Description

Insufficient input validation in system firmware for Intel(R) Xeon(R) Scalable Processors, Intel(R) Xeon(R) Processors D Family, Intel(R) Xeon(R) Processors E5 v4 Family, Intel(R) Xeon(R) Processors E7 v4 Family and Intel(R) Atom(R) processor C Series may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.

Metrics

CVSS 3.1
8.2/10

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Probability
0.39%

30.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
IntelXeon Platinum 8253 FirmwareAll versions
IntelXeon Platinum 8256 FirmwareAll versions
IntelXeon Platinum 8260 FirmwareAll versions
IntelXeon Platinum 8276 FirmwareAll versions
IntelXeon Platinum 8276m FirmwareAll versions
IntelXeon Platinum 8276l FirmwareAll versions
IntelXeon Platinum 8280l FirmwareAll versions
IntelXeon Platinum 8260l FirmwareAll versions
IntelXeon Platinum 8280m FirmwareAll versions
IntelXeon Platinum 8260m FirmwareAll versions
IntelXeon Platinum 8280 FirmwareAll versions
IntelXeon Platinum 8260y FirmwareAll versions
IntelXeon Platinum 8268 FirmwareAll versions
IntelXeon Platinum 8270 FirmwareAll versions
IntelXeon Platinum 8274 FirmwareAll versions
IntelXeon Platinum 8284 FirmwareAll versions
IntelXeon Platinum 9242 FirmwareAll versions
IntelXeon Platinum 9282 FirmwareAll versions
IntelXeon Platinum 8153 FirmwareAll versions
IntelXeon Platinum 8156 FirmwareAll versions
IntelXeon Platinum 8158 FirmwareAll versions
IntelXeon Platinum 8176 FirmwareAll versions
IntelXeon Platinum 8160 FirmwareAll versions
IntelXeon Platinum 8164 FirmwareAll versions
IntelXeon Platinum 8168 FirmwareAll versions
IntelXeon Platinum 8170 FirmwareAll versions
IntelXeon Platinum 8180 FirmwareAll versions
IntelXeon Platinum 8160t FirmwareAll versions
IntelXeon Platinum 8160f FirmwareAll versions
IntelXeon Platinum 8176f FirmwareAll versions
IntelXeon Gold 6210u FirmwareAll versions
IntelXeon Gold 6244 FirmwareAll versions
IntelXeon Gold 6212u FirmwareAll versions
IntelXeon Gold 6240 FirmwareAll versions
IntelXeon Gold 5218 FirmwareAll versions
IntelXeon Gold 6230 FirmwareAll versions
IntelXeon Gold 5222 FirmwareAll versions
IntelXeon Gold 6238t FirmwareAll versions
IntelXeon Gold 6248 FirmwareAll versions
IntelXeon Gold 6252 FirmwareAll versions
IntelXeon Gold 6242 FirmwareAll versions
IntelXeon Gold 6240y FirmwareAll versions
IntelXeon Gold 5217 FirmwareAll versions
IntelXeon Gold 6238m FirmwareAll versions
IntelXeon Gold 5218n FirmwareAll versions
IntelXeon Gold 6226 FirmwareAll versions
IntelXeon Gold 6254 FirmwareAll versions
IntelXeon Gold 5220 FirmwareAll versions
IntelXeon Gold 6238l FirmwareAll versions
IntelXeon Gold 5218b FirmwareAll versions

Showing 50 of 284 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-11137?
Insufficient input validation in system firmware for Intel(R) Xeon(R) Scalable Processors, Intel(R) Xeon(R) Processors D Family, Intel(R) Xeon(R) Processors E5 v4 Family, Intel(R) Xeon(R) Processors E7 v4 Family and Intel(R) Atom(R) processor C Series may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
How severe is CVE-2019-11137?
CVE-2019-11137 has a CVSS score of 8.2/10 (HIGH severity). The EPSS model estimates a 0.39% probability of exploitation in the next 30 days.
How do I fix CVE-2019-11137?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-11137?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST