PT-2019-4084 · Intel · Intel Core+2

Artem Shishkin + 9 · Published 2019-11-12 · Updated 2020-08-24 · CVE-2019-0117

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Intel(R) SGX for 6th, 7th, 8th, 9th Generation Intel(R) Core(TM) Processor Families Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics

Description The issue is related to insufficient access control in the protected memory subsystem, which may allow a privileged user to potentially enable information disclosure via local access. This could lead to the exposure of protected information.

Recommendations For Intel(R) SGX on 6th, 7th, 8th, 9th Generation Intel(R) Core(TM) Processor Families: update the microcode to ensure proper access control. For Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families: apply the recommended configuration changes to restrict local access. For Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics: restrict access to sensitive information until a proper fix is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-04652

CVE-2019-0117

MGASA-2019-0334

MGASA-2019-0413

Affected Products

Intel Core

Intel Sgx

Intel Xeon

References · 21

• https://osv.dev/vulnerability/MGASA-2019-0334 · Vendor Advisory
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00219.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0117 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-0117 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0413 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0413.html · Security Note
• https://advisories.mageia.org/MGASA-2019-0334.html · Security Note
• https://bdu.fstec.ru/vul/2019-04652 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-0117 · Security Note
• https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/master/releasenote · Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00164.html · Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00270.html · Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00210.html · Note
• https://access.redhat.com/solutions/2019-microcode-nov · Note