SB2021021513 - Multiple vulnerabilities in Intel Ethernet Controllers

Description

This security bulletin contains information about 9 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2020-24492)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the firmware. A local administrator can bypass implemented security restrictions and cause a denial of service (DoS) condition on the target system.

2) Improper access control (CVE-ID: CVE-2020-24495)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the firmware. A local administrator can bypass implemented security restrictions and cause a denial of service (DoS) condition on the target system. 

3) Buffer overflow (CVE-ID: CVE-2020-24498)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the firmware. A local administrator can trigger memory corruption and cause a denial of service condition on the target system.

4) Improper access control (CVE-ID: CVE-2020-24494)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the firmware. A local administrator can bypass implemented security restrictions and cause a denial of service (DoS) condition on the target system.

5) Improper access control (CVE-ID: CVE-2020-24497)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the firmware. A local administrator can bypass implemented security restrictions and cause a denial of service (DoS) condition on the target system.

6) Buffer overflow (CVE-ID: CVE-2020-24501)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the firmware. A remote administrator on the local network can trigger memory corruption and cause a denial of service condition on the target system.

7) Input validation error (CVE-ID: CVE-2020-24496)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the firmware. A local administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

8) Input validation error (CVE-ID: CVE-2020-24505)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the firmware. A local administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

9) Buffer overflow (CVE-ID: CVE-2020-24500)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the firmware. A local administrator can trigger memory corruption and cause a denial of service condition on the target system.

Remediation

Install update from vendor's website.

References

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html