What’s Vulnerable › Vulnerabilities

CVE-2019-0145

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-14 · updated 2026-06-17
• Weakness: CWE-120

Description

Buffer overflow in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable an escalation of privilege via local access.

Affected products

• Intel Ethernet 700 Series Software: before 24.0 — fixed in 24.0
• Intel Ethernet Controller 710-Bm1 Firmware: before 7.0 — fixed in 7.0
• Intel Ethernet Controller X710-At2 Firmware: before 7.0 — fixed in 7.0
• Intel Ethernet Controller X710-Bm2 Firmware: before 7.0 — fixed in 7.0
• Intel Ethernet Controller X710-Tm4 Firmware: before 7.0 — fixed in 7.0
• Intel Ethernet Controller Xxv710-Am1 Firmware: before 7.0 — fixed in 7.0
• Intel Ethernet Controller Xxv710-Am2 Firmware: before 7.0 — fixed in 7.0
• Linux kernel: from 4.6 before 4.9.244; from 4.10 before 4.14.205; from 4.15 before 4.19.139; from 4.20 before 5.2 — fixed in 4.14.205, 4.19.139, 4.9.244, 5.2

How to fix

Upgrade to a fixed version: Intel Ethernet 700 Series Software 24.0; Intel Ethernet Controller 710-Bm1 Firmware 7.0; Intel Ethernet Controller X710-At2 Firmware 7.0; Intel Ethernet Controller X710-Bm2 Firmware 7.0; Intel Ethernet Controller X710-Tm4 Firmware 7.0; Intel Ethernet Controller Xxv710-Am1 Firmware 7.0; Intel Ethernet Controller Xxv710-Am2 Firmware 7.0; Linux kernel 4.14.205, 4.19.139, 4.9.244, 5.2. Check the vendor advisory for mitigations.

References

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html

Get alerted when CVE-2019-0145 or the next vulnerability affects your stack