High severity · published Nov 14, 2019
CVE-2019-14566
Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2I
2019.2 IPU – Intel(R) SGX · Intel
See provided reference · source: vendor
SG
Software Guard Extensions Sdk · Intel
2.3.100.49777; 2.3.101.50222; 2.4.100.51291; 2.2.100.45311; 2.3.100.46354; 2.4.100.48163; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14566
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14566
support.f5.com
https://support.f5.com/csp/article/K57201259?utm_source=f5support&%3Butm_medium=RSS
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html
More from 2019.2 IPU – Intel(R) SGX
7.8
CVE-2019-14565
Insufficient initialization in Intel(R) SGX SDK Windows versions 2.4.100.51291 and earlier, and Linux versions 2.6.100.51363 and earlier, may allow an authenticated user to enable…