PT-2019-4702 · Intel · Intel Processors+1

Published 2019-12-10 · Updated 2021-07-21 · CVE-2019-11157

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Intel Processors (affected versions not specified)

Description The issue is related to insufficient checking of exceptional states in Intel processor microcode, which may allow an attacker to elevate privileges or disclose protected information. This can be achieved through local access by exploiting improper conditions in voltage settings for some Intel processors. Researchers have demonstrated a technique, known as Plundervolt, that compromises the integrity of Intel SGX technology on modern processors by tweaking the CPU's voltage, resulting in easy retrieval of sensitive data protected by hardware-isolated SGX enclaves.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2020-01097

CVE-2019-11157

Affected Products

Intel Processors

Intel Sgx

References · 13

• 🔥 https://github.com/zkenjar/v0ltpwn · Exploit
• https://bdu.fstec.ru/vul/2020-01097 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-11157 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11157 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11157 · Security Note
• https://github.com/KitMurdock/plundervolt · Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00289.html · Note
• https://t.me/tmfeed/73973 · Telegram Post
• https://t.me/cybersecuritytechnologies/490 · Telegram Post
• https://support.f5.com/csp/article/K10321239?utm_source=f5support&amp%3Butm_medium=RSS · Note
• https://security.netapp.com/advisory/ntap-20191217-0001 · Note
• https://t.me/thehackernews/556 · Telegram Post