Intel Family Security Update Advisory

MalBot · August 20, 2024, 10:01pm

Overview

An update has been released to address vulnerabilities in Intel products. Users of the affected versions are advised to update to the latest version.

Affected Products

CVE-2024-26022

Intel® Aptio V UEFI Firmware Integrator Tools (Intel® NUC iSetupCfgWin software) versions: ~ 5.05.04.0008 (excluded)
Intel® Aptio V UEFI Firmware Integrator Tools (Intel® NUC iSetupCfgLnx software) versions: ~ 5.05.04.0008 (excluded)
Intel® Aptio V UEFI Firmware Integrator Tools (Intel® NUC iFlashVLnx software) versions: ~ 5.05.04.0008 (excluded)
Intel® Aptio V UEFI Firmware Integrator Tools (Intel® NUC iFlashVWin software) versions: ~ 5.05.04.0008 (excluded)
Intel® Aptio V UEFI Firmware Integrator Tools (Intel® NUC iDmiEdit-Win software) versions: ~ 5.05.04.0008 (excluded)
Intel® Aptio V UEFI Firmware Integrator Tools (Intel® NUC iDmiEditLnx software) versions: ~ 5.05.04.0008 (excluded)

CVE-2024-28947

Intel® Server Board S2600ST Family firmware versions: ~ 02.01.0017 (excluded)

CVE-2024-25576

Intel Agilex® FPGA 7 FPGA firmware versions: ~ 24.1 (excluded)

CVE-2024-24853

See “Affected Products” section in References [4]

CVE-2023-49144

OpenBMC Firmware (Intel® Server Platforms) versions: ~ egs-1.15-0 (excluded)
OpenBMC Firmware (Intel® Server Platforms) versions: ~ bhs-0.27 (excluded)

CVE-2024-21801

Intel® TDX module software versions: ~ 1.5.05.46.698 (excluded)

CVE-2023-49141

See “Affected Products” section in references [7]

CVE-2023-42667

Intel® Core Ultra processors

CVE-2024-34163

Intel® NUC X15 Laptop

LAPAC71G and LAPAC71H versions: ~ 0065 (excluded)
LAPBC510 and LAPBC710 versions: ~ 0083 (excluded)
LAPRC510 and LAPRC710 versions: ~ 0066 (excluded)
LAPKC51E and LAPKC71E and LAPKC71F versions: ~ 0048 (excluded)

CVE-2024-39283

Intel® TDX module software versions: ~ 1.5.01.00.592 (inclusive)

CVE-2024-23981, CVE-2024-24986, CVE-2024-23497, CVE-2024-23499, CVE-2024-21807, CVE-2024-21810

Intel(R) Ethernet Complete Driver Pack versions: ~ 28.3 (excluded)

CVE-2024-24983

Intel(R) Ethernet Controllers E800 Series with NVM image versions: ~ 4.4 (excluded)

CVE-2024-21787

BMRA software versions: ~ 22.08 (excluded)

Resolved Vulnerabilities

Vulnerability that could potentially allow an authenticated user to escalate privileges via local access due to inadequate access controls (CVE-2024-26022)

Vulnerability in the kernel mode driver in Intel(R) server board S2600ST family firmware where improper input validation could potentially allow an authorized user to escalate privileges via local access (CVE-2024-28947)

Improper access control in firmware in Intel(R) FPGA products could allow a privileged user to escalate privileges via local access (CVE-2024-25576)

Vulnerability in Intel(R) processors due to incorrect sequence of actions when switching between execution monitor and SMI transfer monitor (STM), which could allow a privileged user to escalate privileges via local access (CVE-2024-24853)

Vulnerability in OpenBMC firmware on Intel(R) server platforms with out-of-bounds read permissions that could potentially allow a privileged user to enable information disclosure via local access (CVE-2023-49144)

Vulnerability in Intel(R) TDX module software due to a lack of control flow management that could potentially allow a privileged user to cause a denial of service via local access (CVE-2024-21801)

Vulnerability in Intel(R) processor stream cache mechanism due to improper isolation, potentially allowing an authenticated user to escalate privileges via local access (CVE-2023-49141)

Vulnerability in the Intel(R) Core(TM) Ultra Processor stream cache mechanism due to improper isolation, which could allow an authenticated user to escalate privileges via local access (CVE-2023-42667)

Vulnerability in the firmware of Intel(R) NUCs due to improper input validation, potentially allowing an authorized user to escalate privileges via local access (CVE-2024-34163)

Vulnerability in Intel(R) TDX module software where incomplete filtering of special elements could potentially allow an authenticated user to escalate privileges via local access (CVE-2024-39283)

A wraparound error in the Linux kernel mode driver in Intel(R) Ethernet network controllers and adapters could potentially allow an authenticated user to enable privilege escalation via local access (CVE-2024-23981)

Vulnerability in the Linux kernel mode driver in Intel(R) Ethernet network controllers and adapters due to improper access control that could potentially allow an authenticated user to escalate privileges via local access (CVE-2024-24986)

An out-of-bounds write in the Linux kernel mode driver for Intel(R) Ethernet network controllers and adapters could potentially allow an authenticated user to escalate privileges via local access (CVE-2024-23497)

Vulnerability in the Linux kernel mode driver for the Intel(R) Ethernet Network Controllers and Adapters E810 Series, where a protection mechanism error could potentially allow an unauthenticated user to cause a denial of service via network access (CVE-2024-23499)

Vulnerability in the Linux kernel mode driver for Intel(R) Ethernet network controllers and adapters that could potentially allow an authenticated user to escalate privileges via local access due to improper initialization (CVE-2024-21807)

Vulnerability in the Linux kernel-mode driver for Intel(R) Ethernet network controllers and adapters due to improper input validation, potentially allowing an authenticated user to escalate privileges via local access (CVE-2024-21810)

Vulnerability in the firmware of Intel(R) Ethernet Network Controllers and Adapters E810 Series, where a protection mechanism error could potentially allow an unauthenticated user to cause a denial of service via network access (CVE-2024-24983)

Vulnerability in BMRA software due to insufficient cryptographic strength, potentially allowing an authenticated user to escalate privileges via local access (CVE-2024-21787)

Vulnerability Patches

The following product-specific Vulnerability Patches have been made available in the latest update. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.

CVE-2024-26022