Information disclosure in Intel products - CVE-2021-0072

Vulnerability identifier: #VU60515

CSH Severity: Low

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-0072

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local administrator can gain unauthorized access to sensitive information on the system.

Intel Wi-Fi 6E AX210
Intel Wi-Fi 6 AX201
Intel Wi-Fi 6 AX200
Intel Wireless-AC 9560
Intel Wireless-AC 9462
Intel Wireless-AC 9461
Intel Wireless-AC 9260
Intel Dual Band Wireless-AC 8265
Intel Dual Band Wireless-AC 8260
Intel Dual Band Wireless-AC 3168
Intel Wireless 7265 (Rev D) Family
Intel Dual Band Wireless-AC 3165
Intel Wi-Fi 6 AX210
Killer Wi-Fi 6E AX1675
Killer Wi-Fi 6 AX1650
Killer Wireless-AC 1550
Killer
Intel Active Management Technology Wireless
Intel PROSet/Wireless WiFi Software for Windows
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
kernel-firmware
ucode-amd

Install updates from vendor's website.

Killer - update to 3.0
Intel Active Management Technology Wireless - addressed in versions 11.8.90, 12.0.85, 14.1.60, 15.0.35
Intel PROSet/Wireless WiFi Software for Windows - update to 22.60
kernel-firmware - update to 20200107-3.26.1
ucode-amd - update to 20200107-3.26.1

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00539.html

• Multiple vulnerabilities in Intel PROSet/Wireless Wi-Fi, AMT Wireless and Killer Wi-Fi Software
• SUSE update for kernel-firmware