K56215245 : Intel CPU vulnerabilities CVE-2019-11136 and CVE-2019-11137

Security Advisory Description

• CVE-2019-11136

Insufficient access control in system firmware for Intel® Xeon® Scalable Processors, 2nd Generation Intel® Xeon® Scalable Processors and Intel® Xeon® Processors D Family may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.

• CVE-2019-11137

Insufficient input validation in system firmware for Intel® Xeon® Scalable Processors, Intel® Xeon® Processors D Family, Intel® Xeon® Processors E5 v4 Family, Intel® Xeon® Processors E7 v4 Family and Intel® Atom® processor C Series may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.

Impact

There is no impact; F5 products are not affected by this vulnerability.

However, in cloud and Virtual Edition (VE) environments, preventing these attacks falls on the hypervisor/host platform, outside the scope of F5’s ability to support or patch. Please contact your cloud provider or hypervisor vendor to ensure their platforms or products are not subject to this vulnerability.