Input validation error in Intel products - CVE-2021-0066

Vulnerability identifier: #VU60516

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-0066

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local attacker can pass specially crafted input to the application and gain elevated privileges.

Intel Wi-Fi 6E AX210
Intel Wi-Fi 6 AX201
Intel Wi-Fi 6 AX200
Intel Wireless-AC 9560
Intel Wireless-AC 9462
Intel Wireless-AC 9461
Intel Wireless-AC 9260
Intel Dual Band Wireless-AC 8265
Intel Dual Band Wireless-AC 8260
Intel Dual Band Wireless-AC 3168
Intel Wireless 7265 (Rev D) Family
Intel Dual Band Wireless-AC 3165
Intel Wi-Fi 6 AX210
Killer Wi-Fi 6E AX1675
Killer Wi-Fi 6 AX1650
Killer Wireless-AC 1550
Killer
Intel Active Management Technology Wireless
Intel PROSet/Wireless WiFi Software for Windows
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
kernel-firmware
ucode-amd

Install updates from vendor's website.

Killer - update to 3.0
Intel Active Management Technology Wireless - addressed in versions 11.8.90, 12.0.85, 14.1.60, 15.0.35
Intel PROSet/Wireless WiFi Software for Windows - update to 22.60
kernel-firmware - update to 20200107-3.26.1
ucode-amd - update to 20200107-3.26.1

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00539.html

• Multiple vulnerabilities in Intel PROSet/Wireless Wi-Fi, AMT Wireless and Killer Wi-Fi Software
• SUSE update for kernel-firmware