Processor vulnerability
CVE-2019-11157
Privileged software could change the voltage settings of 6th to 10th generation Core processors to escalate privilege or disclose information; fixed in BIOS.
- Name
- Voltage Settings Modification
- Vulnerability
- Voltage Settings Modification
- Kind
- Fault injection
- CVE published
- 2019-12-16 CVE record
- Advisories
- INTEL-SA-00289
An improper conditions check in the voltage settings of Intel’s
client processors let a privileged local user change them in a way
that could escalate privilege or disclose information. The fix is a
BIOS update from the system manufacturer, which Intel paired with an
SGX TCB recovery so that enclave attestation can tell updated
systems apart. Intel lists 6th to 10th generation Core, Xeon E3 v5
and v6, and Xeon E-2100 and E-2200.What the sources say of each microarchitecture.
Affected processors
4 of the 4 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Skylake | Affected | INTEL-SA-00289 lists CPUID 506E3 and 406E3 (6th generation Core, Xeon E3 v5) | intel.com |
| Kaby Lake | Affected | INTEL-SA-00289 lists CPUID 906E9 and 806E9 (7th generation Core, Xeon E3 v6) | intel.com |
| Coffee Lake | Affected | INTEL-SA-00289 lists CPUID 906EA, 906EB, 906ED, 806EA and 806EB (8th and 9th generation Core, Xeon E) | intel.com |
| Comet Lake | Affected | INTEL-SA-00289 lists CPUID A0660 (10th generation Core mobile) | intel.com |
Mitigations
- Firmware: A BIOS update from the system manufacturer, with an SGX TCB recovery so that attestation can tell updated systems apart. Source.
Related CVEs
- CVE-2019-11139 Voltage Setting Modulation: Xeon Scalable