fkie_nvd - fkie_cve-2019-14566

FKIE_CVE-2019-14566

Vulnerability from fkie_nvd - Published: 2019-11-14 17:15 - Updated: 2024-11-21 04:26

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access.

References

URL	Tags
secure@intel.com	https://support.f5.com/csp/article/K57201259?utm_source=f5support&amp%3Butm_medium=RSS
secure@intel.com	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://support.f5.com/csp/article/K57201259?utm_source=f5support&amp%3Butm_medium=RSS
af854a3a-2127-422b-91ae-364da2661108	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html	Vendor Advisory

Impacted products

Vendor	Product	Version
intel	software_guard_extensions_sdk	2.3.100.49777
intel	software_guard_extensions_sdk	2.3.101.50222
intel	software_guard_extensions_sdk	2.4.100.51291
microsoft	windows	-
intel	software_guard_extensions_sdk	2.2.100.45311
intel	software_guard_extensions_sdk	2.3.100.46354
intel	software_guard_extensions_sdk	2.4.100.48163
intel	software_guard_extensions_sdk	2.5.100.49891
intel	software_guard_extensions_sdk	2.6.100.51363
linux	linux_kernel	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:intel:software_guard_extensions_sdk:2.3.100.49777:*:*:*:*:*:*:*",
              "matchCriteriaId": "0937BA08-E9BD-4903-AC84-4B46F3200F00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:intel:software_guard_extensions_sdk:2.3.101.50222:*:*:*:*:*:*:*",
              "matchCriteriaId": "6578D9CF-A3AF-46D2-B3A4-BC1D3DB30D28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:intel:software_guard_extensions_sdk:2.4.100.51291:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB2170C4-97DE-472C-9855-12E388999DC6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:intel:software_guard_extensions_sdk:2.2.100.45311:*:*:*:*:*:*:*",
              "matchCriteriaId": "9DB426EB-41DA-4F17-8844-EA65A8B97DC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:intel:software_guard_extensions_sdk:2.3.100.46354:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1E27192-41CF-4AAB-80E8-36F1CFBEF626",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:intel:software_guard_extensions_sdk:2.4.100.48163:*:*:*:*:*:*:*",
              "matchCriteriaId": "46A915C7-31F6-4C8D-82CB-76CD6625DAAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:intel:software_guard_extensions_sdk:2.5.100.49891:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AF40835-E44D-47AC-AECB-4007E0F26D20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:intel:software_guard_extensions_sdk:2.6.100.51363:*:*:*:*:*:*:*",
              "matchCriteriaId": "87BC2909-B984-459B-B659-7D681BA9D8C5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access."
    },
    {
      "lang": "es",
      "value": "Una comprobaci\u00f3n de entrada insuficiente en Intel\u00ae SGX SDK m\u00faltiples versiones de Linux y Windows, puede habilitar a un usuario autenticado para permitir una divulgaci\u00f3n de informaci\u00f3n, una escalada de privilegios o una denegaci\u00f3n de servicio por medio de un acceso local."
    }
  ],
  "id": "CVE-2019-14566",
  "lastModified": "2024-11-21T04:26:58.390",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-11-14T17:15:14.617",
  "references": [
    {
      "source": "secure@intel.com",
      "url": "https://support.f5.com/csp/article/K57201259?utm_source=f5support\u0026amp%3Butm_medium=RSS"
    },
    {
      "source": "secure@intel.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://support.f5.com/csp/article/K57201259?utm_source=f5support\u0026amp%3Butm_medium=RSS"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html"
    }
  ],
  "sourceIdentifier": "secure@intel.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2019-14566 (GCVE-0-2019-14566)

Vulnerability from cvelistv5 – Published: 2019-11-14 16:46 – Updated: 2024-08-05 00:19

Summary

Severity ?

No CVSS data available.

CWE

Escalation of Privilege, Denial of Service, Information Disclosure

Assigner

intel

References

URL

Tags

	https://www.intel.com/content/www/us/en/security-…	x_refsource_MISC
	https://support.f5.com/csp/article/K57201259?utm_…	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Intel	2019.2 IPU – Intel(R) SGX	Affected: See provided reference

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.316Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K57201259?utm_source=f5support\u0026amp%3Butm_medium=RSS"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "2019.2 IPU \u2013 Intel(R) SGX",
          "vendor": "Intel",
          "versions": [
            {
              "status": "affected",
              "version": "See provided reference"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege, Denial of Service, Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-19T07:06:57",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K57201259?utm_source=f5support\u0026amp%3Butm_medium=RSS"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14566",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "2019.2 IPU \u2013 Intel(R) SGX",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "See provided reference"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Intel"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Escalation of Privilege, Denial of Service, Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html",
              "refsource": "MISC",
              "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html"
            },
            {
              "name": "https://support.f5.com/csp/article/K57201259?utm_source=f5support\u0026amp;utm_medium=RSS",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K57201259?utm_source=f5support\u0026amp;utm_medium=RSS"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14566",
    "datePublished": "2019-11-14T16:46:00",
    "dateReserved": "2019-08-03T00:00:00",
    "dateUpdated": "2024-08-05T00:19:41.316Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2019-14566

CVE-2019-14566 (GCVE-0-2019-14566)

Tags

Sightings

Nomenclature