Intel Xeon system firmware: insufficient access control lets a privileged local user escalate or leak memory

CVSS 6.7CVE-2019-11136Firmware, BMC & network fabriccurated

Impact

A user already holding root or an equivalently privileged local context on a Xeon Scalable (1st/2nd gen) or Xeon D node can use a system firmware access-control gap to escalate further, disclose information, or hang the box. On a GPU node that matters because the escalation target is below the OS: code that survives a host reinstall and sits outside anything the hypervisor or the container runtime can see, on a machine that is typically shared across jobs and expensive to take out of the fleet. Intel's advisory (INTEL-SA-00280) describes the three impacts generically and does not say which firmware component is at fault, so treat the exact primitive as unestablished. Exploitation requires high privilege, which puts this in the defence-in-depth bucket rather than the drop-everything bucket.

Who can reach it

Local access on the host, authenticated, and already privileged (CVSS PR:H). Not reachable from a tenant container or VM without a prior host-root compromise, and not reachable over the network or the management VLAN.

What to do

Pick up the 2019.2 IPU UEFI/BIOS payload from the server OEM, not from Intel - Intel ships the microcode and reference firmware, the OEM ships the installable image (HPE published it as HPESBHF03967). That is a BIOS flash: schedule the node out of service, drain running jobs, flash, and reboot. Verify the resulting BIOS version against the OEM's advisory afterwards, because the IPU payload lands in different OEM BIOS releases per platform. F5 also shipped a vendor-specific fix for its own appliances (K56215245).

References

https://nvd.nist.gov/vuln/detail/CVE-2019-11136 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00280.html https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03967en_us https://support.f5.com/csp/article/K56215245?utm_source=f5support&amp%3Butm_medium=RSS

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.