CVE-2019-11090

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-18 · updated 2026-06-17
Weakness: CWE-362

Description

Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) SPS before versions SPS_E5_04.01.04.305.0, SPS_SoC-X_04.00.04.108.0, SPS_SoC-A_04.00.04.191.0, SPS_E3_04.01.04.086.0, SPS_E3_04.08.04.047.0 may allow an unauthenticated user to potentially enable information disclosure via network access.

Affected products

Intel Platform Trust Technology Firmware: from 11.0 through 11.8.70; from 11.10 before 11.11.70; from 11.20 before 11.22.70; from 12.0 before 12.0.45; from 13.0 before 13.0.0; from 14.0.0 before 14.0.10 — fixed in 11.11.70, 11.22.70, 12.0.45, 13.0.0, 14.0.10
Intel Corporation Server Platform Services: from sps_e3_04.01.00.000.0 before sps_e3_04.01.04.086.0; from sps_e5_04.00.00.000.0 before sps_e5_04.01.04.305.0; from sps_soc-a_04.00.00.000.0 before sps_soc-a_04.00.04.191.0; from sps_soc-x_04.00.00.000.0 before sps_soc-x_04.00.04.108.0 — fixed in sps_e3_04.01.04.086.0, sps_e5_04.01.04.305.0, sps_soc-a_04.00.04.191.0, sps_soc-x_04.00.04.108.0
Intel Corporation Trusted Execution Engine: from 3.0 before 3.1.70; from 4.0 before 4.0.20 — fixed in 3.1.70, 4.0.20

How to fix

Upgrade to a fixed version: Intel Platform Trust Technology Firmware 11.11.70, 11.22.70, 12.0.45, 13.0.0; Intel Corporation Server Platform Services sps_e3_04.01.04.086.0, sps_e5_04.01.04.305.0, sps_soc-a_04.00.04.191.0, sps_soc-x_04.00.04.108.0; Intel Corporation Trusted Execution Engine 3.1.70, 4.0.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-11090 or the next vulnerability affects your stack