High severity · published Feb 13, 2020
CVE-2020-0561
Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Backports · Opensuse
sle-15 · source: NVD
LE
Leap · Opensuse
15.1 · source: NVD
SG
Software Guard Extensions Sdk · Intel
before 2.6.100.1; before 2.8.100.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-0561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-0561
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00009.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00014.html
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00336.html
More from Software Guard Extensions Sdk
7.8
CVE-2019-14565
Insufficient initialization in Intel(R) SGX SDK Windows versions 2.4.100.51291 and earlier, and Linux versions 2.6.100.51363 and earlier, may allow an authenticated user to enable…
7.8
CVE-2019-14566
Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or…
7.1
CVE-2019-0122
Double free in Intel(R) SGX SDK for Linux before version 2.2 and Intel(R) SGX SDK for Windows before version 2.1 may allow an authenticated user to potentially enable information…