CVE-2019-18579

CVE-2019-18579 affects the Dell XPS 13 2‑in‑1 (7390) BIOS prior to version 1.1.3, where the default setting Enable Thunderbolt (and PCIe behind TBT) pre‑boot modules was enabled. This enables a local, unauthenticated attacker with physical access to perform a pre‑boot DMA attack and gain read/wri...

CVE-2019-18579

Settings for the Dell XPS 13 2-in-1 7390 BIOS versions prior to 1.1.3 contain a configuration vulnerability. The BIOS configuration for the "Enable Thunderbolt and PCIe behind TBT pre-boot modules" setting is enabled by default. A local unauthenticated attacker with physical access to a user's...

Modern Intel CPUs Plagued By Plundervolt Attack

Researchers have discovered a new attack impacting modern Intel CPUs, which could allow an attacker to extract highly-sensitive information – such as encryption keys – from affected processors by altering their voltage. The attack, dubbed “Plundervolt,” centers around Intel Software Guard...

New PlunderVolt Attack Targets Intel SGX Enclaves by Tweaking CPU Voltage

A team of cybersecurity researchers demonstrated a novel yet another technique to hijack Intel SGX, a hardware-isolated trusted space on modern Intel CPUs that encrypts extremely sensitive data to shield it from attackers even when a system gets compromised. Dubbed Plundervolt and tracked as...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Multiple Intel NUC Firmware Multiple Security Vulnerabilities

Description Multiple Intel NUC Firmware are prone to multiple unspecified security vulnerabilities. Attackers can leverage these issues to gain elevated privileges. Technologies Affected Intel Compute Card CD1IV128MK BIOS Intel Compute Card CD1M3128MK BIOS Intel Compute Card CD1P64GK BIOS Intel...

Dell Command Configure Code Issue Vulnerability

Dell Command Configure is a Dell USA application that provides configuration capabilities for business client platforms. The program contains both a command line interface and a graphical user interface for configuring a variety of BIOS features. A code issue vulnerability exists in Dell Command...

Command injection

On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or...

CVE-2019-19642

On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or...

CVE-2019-19642

CVE-2019-19642 affects SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68. The vulnerability in the Virtual Media feature allows OS command injection by authenticated attackers who can send HTTP POST requests to the IPMI interface at /rpc/setvmdrive.asp, including shell metach...

2019.2 IPU – Intel® Processor Graphics SMM Advisory

Summary: A potential security vulnerability in System Management Mode SMM with Intel® Processor Graphics may allow information disclosure. Intel is releasing guidance to SMM developers to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2019-0185 Description: Insufficient...

2019.2 IPU – Intel® SGX with Intel® Processor Graphics Update Advisory

Summary: A potential security vulnerability in Intel® Software Guard Extensions SGX enabled processors with Intel® Processor Graphics may allow information disclosure. Intel is releasing software and firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID:...

Debian DLA-1990-1 : linux-4.9 security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, or information leak. CVE-2018-12207 It was discovered that on Intel CPUs supporting hardware virtualisation with Extended Page Tables EPT, a guest VM may manipulate the...

Debian DLA-1989-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, or information leak. CVE-2019-0154 Intel discovered that on their 8th and 9th generation GPUs, reading certain registers while the GPU is in a low-power state can cause a...

CVE-2019-6188

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for unauthorized access...

CVE-2019-6188

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for unauthorized access...

Design/Logic Flaw

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for unauthorized access...

CVE-2019-6188 ThinkPad T460p and T470p BIOS Tamper Mechanism

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for unauthorized access...

CVE-2019-6188

CVE-2019-6188 affects Lenovo ThinkPad T460p and T470p where the BIOS tamper-detection mechanism failed to trigger, potentially enabling unauthorized access. Reported by multiple sources (NVD entry mirrors Lenovo advisory LEN-27714 and Red Hat/RH-CVE mappings) with BIOS versions up to R07ET90W (T4...

2019.2 IPU – Intel® SGX and TXT Advisory

Summary: Potential security vulnerabilities in Intel® Software Guard Extensions SGX and Intel® Trusted Execution Technology TXT may allow escalation of privilege. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2019-0123...