SB2021032620 - Multiple vulnerabilities in Intel 722 Ethernet Controllers in F5OS

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2020-24492)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the firmware. A local administrator can bypass implemented security restrictions and cause a denial of service (DoS) condition on the target system.

2) Improper access control (CVE-ID: CVE-2020-24493)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the firmware. A local administrator can bypass implemented security restrictions and cause a denial of service (DoS) condition on the target system.

3) Improper access control (CVE-ID: CVE-2020-24494)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the firmware. A local administrator can bypass implemented security restrictions and cause a denial of service (DoS) condition on the target system.

4) Improper access control (CVE-ID: CVE-2020-24495)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the firmware. A local administrator can bypass implemented security restrictions and cause a denial of service (DoS) condition on the target system. 

5) Input validation error (CVE-ID: CVE-2020-24496)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the firmware. A local administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://support.f5.com/csp/article/K91610944