Intel Core Processor/Pentium/Celeron/Atom/Xeon up to 26.20.100.6812 privileges management

Summaryinfo

A vulnerability marked as critical has been reported in Intel Core Processor, Pentium, Celeron, Atom and Xeon up to 26.20.100.6812. Affected by this issue is some unknown functionality. This manipulation causes privileges management. This vulnerability is tracked as CVE-2019-0155. The attack is restricted to local execution. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Intel Core Processor, Pentium, Celeron, Atom and Xeon up to 26.20.100.6812 (Chip Software) and classified as critical. Affected by this vulnerability is an unknown code. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R) Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077 (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an authenticated user to potentially enable escalation of privilege via local access.

The weakness was disclosed 11/14/2019 (Website). The advisory is shared at access.redhat.com. This vulnerability is known as CVE-2019-0155 since 11/13/2018. An attack has to be approached locally. A single authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading eliminates this vulnerability.

The entry VDB-145596 is pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Chip Software

Vendor

• Intel

Name

• Atom
• Celeron
• Core Processor
• Pentium
• Xeon

Version

• 26.20.100.6812

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion