CVE-2019-10636 : Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS91

Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS9190, 88SS1085, 88SS1087, 88SS1090, 88SS1100, 88SS1084, 88SS1088, & 88SS1098) devices allow reprogramming flash memory to bypass the secure boot protection mechanism.

Published 2019-06-04 21:29:01

Updated 2020-08-24 17:37:01

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-10636

Marvell » 88ss1074 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1074_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1074 » Version: N/A
Marvell » 88ss1079 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1079_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1079 » Version: N/A
Marvell » 88ss1080 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1080_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1080 » Version: N/A
Marvell » 88ss1093 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1093_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1093 » Version: N/A
Marvell » 88ss1092 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1092_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1092 » Version: N/A
Marvell » 88ss1095 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1095_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1095 » Version: N/A
Marvell » 88ss9174 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss9174_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss9174 » Version: N/A
Marvell » 88ss9175 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss9175_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss9175 » Version: N/A
Marvell » 88ss9187 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss9187_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss9187 » Version: N/A
Marvell » 88ss9188 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss9188_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss9188 » Version: N/A
Marvell » 88ss9189 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss9189_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss9189 » Version: N/A
Marvell » 88ss9190 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss9190_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss9190 » Version: N/A
Marvell » 88ss1085 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1085_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1085 » Version: N/A
Marvell » 88ss1087 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1087_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1087 » Version: N/A
Marvell » 88ss1090 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1090_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1090 » Version: N/A
Marvell » 88ss1100 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1100_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1100 » Version: N/A
Marvell » 88ss1084 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1084_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1084 » Version: N/A
Marvell » 88ss1088 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1088_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1088 » Version: N/A
Marvell » 88ss1098 Firmware » Version: N/A
cpe:2.3:o:marvell:88ss1098_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Marvell » 88ss1098 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-10636

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 23 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-10636

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.9	MEDIUM	AV:L/AC:L/Au:N/C:N/I:C/A:N	3.9	6.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Complete Availability Impact: None
4.6	MEDIUM	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	0.9	3.6	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2019-10636

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-10636

https://www.marvell.com/documents/x9g4hrszt5ls3udbe1eo/

Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2019-10636

Products affected by CVE-2019-10636

Exploit prediction scoring system (EPSS) score for CVE-2019-10636

CVSS scores for CVE-2019-10636

CWE ids for CVE-2019-10636

References for CVE-2019-10636