← Back

CVE-2019-11090

nvd nist
Published: Dec 18, 2019Modified: Nov 21, 2024

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.2 / Impact: 3.6
Source: NVD

Description

Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) SPS before versions SPS_E5_04.01.04.305.0, SPS_SoC-X_04.00.04.108.0, SPS_SoC-A_04.00.04.191.0, SPS_E3_04.01.04.086.0, SPS_E3_04.08.04.047.0 may allow an unauthenticated user to potentially enable information disclosure via network access.

Affected (13)

Intel
3 products
Platform Trust Technology Firmware
Server Platform Services Firmware
Trusted Execution Engine Firmware
Configuration A
13 vulnerable
Vulnerable SoftwareAffected Versions
Intel
Platform Trust Technology Firmware
From 11.0 to 11.8.70
Platform Trust Technology Firmware
From 11.10 to 11.11.70
Platform Trust Technology Firmware
From 11.20 to 11.22.70
Platform Trust Technology Firmware
From 12.0 to 12.0.45
Platform Trust Technology Firmware
From 13.0 to 13.0.0
Platform Trust Technology Firmware
From 14.0.0 to 14.0.10
Intel
Server Platform Services Firmware
All versions
Server Platform Services Firmware
From sps_e3_04.01.00.000.0 to sps_e3_04.01.04.086.0
Server Platform Services Firmware
From sps_e5_04.00.00.000.0 to sps_e5_04.01.04.305.0
Server Platform Services Firmware
From sps_soc-a_04.00.00.000.0 to sps_soc-a_04.00.04.191.0
Server Platform Services Firmware
From sps_soc-x_04.00.00.000.0 to sps_soc-x_04.00.04.108.0
Intel
Trusted Execution Engine Firmware
From 3.0 to 3.1.70
Trusted Execution Engine Firmware
From 4.0 to 4.0.20

Related CWEs

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (2)

Source: secure@intel.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.