SB2022021008 - Multiple vulnerabilities in Intel PROSet/Wireless Wi-Fi, AMT Wireless and Killer Wi-Fi Software
Published: February 10, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 23 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2021-0172)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in firmware. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
2) Information disclosure (CVE-ID: CVE-2021-0072)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local administrator can gain unauthorized access to sensitive information on the system.
3) Input validation error (CVE-ID: CVE-2021-0183)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of specified index, position, or offset in Input in software. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
4) Input validation error (CVE-ID: CVE-2021-0179)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper use of validation framework in software. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
5) Input validation error (CVE-ID: CVE-2021-0178)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in software. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
6) Input validation error (CVE-ID: CVE-2021-0177)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of consistency within input in software. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
7) Input validation error (CVE-ID: CVE-2021-0176)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.
8) Input validation error (CVE-ID: CVE-2021-0076)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of specified index, position, or offset in Input in firmware. A local administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.
9) Input validation error (CVE-ID: CVE-2021-0175)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of specified index, position, or offset in Input in firmware. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
10) Input validation error (CVE-ID: CVE-2021-0174)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper use of validation framework in firmware. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
11) Input validation error (CVE-ID: CVE-2021-0173)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of consistency within input in firmware. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
12) Improper access control (CVE-ID: CVE-2021-0171)
The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in software. A local user can bypass implemented security restrictions and enable information disclosure.
13) Input validation error (CVE-ID: CVE-2021-0162)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input in software. A remote attacker on the local network can pass specially crafted input to the application and gain elevated privileges on the target system.
14) Information disclosure (CVE-ID: CVE-2021-0170)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to exposure of sensitive information to an unauthorized actor in firmware. A local user can gain unauthorized access to sensitive information on the system.
15) Input validation error (CVE-ID: CVE-2021-0168)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local administrator can enable escalation of privileges.
16) Untrusted search path (CVE-ID: CVE-2021-0169)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to uncontrolled search path element in software. A local administrator can enable escalation of privileges.
17) Improper access control (CVE-ID: CVE-2021-0167)
The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in software. A local administrator can bypass implemented security restrictions and gain elevated privileges on the system.
18) Input validation error (CVE-ID: CVE-2021-0166)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to exposure of sensitive information to an unauthorized actor in firmware. A local administrator can enable escalation of privileges.
19) Input validation error (CVE-ID: CVE-2021-0066)
The vulnerability allows a local attacker to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local attacker can pass specially crafted input to the application and gain elevated privileges.
20) Input validation error (CVE-ID: CVE-2021-0165)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in firmware. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
21) Improper access control (CVE-ID: CVE-2021-0164)
The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in firmware. A local user can bypass implemented security restrictions and gain elevated privileges on the system.
22) Input validation error (CVE-ID: CVE-2021-0161)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local administrator on the local network can pass specially crafted input to the application and gain elevated privileges on the target system.
23) Input validation error (CVE-ID: CVE-2021-0163)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to improper validation of consistency within input in software. A remote attacker on the local network can pass specially crafted input to the application and gain elevated privileges on the target system.
Remediation
Install update from vendor's website.