SB2023053144 - Multiple vulnerabilities in Intel Server Board BMC
Published: May 31, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2023-22661)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A local administrator can trigger memory corruption and execute arbitrary code on the target system with elevated privileges.
2) Access of Memory Location After End of Buffer (CVE-ID: CVE-2023-22297)
The vulnerability allows a local administrator to escalate privileges on the system.
The vulnerability exists due to access of memory location after end of buffer, which leads to security restrictions bypass and privilege escalation.
3) Buffer overflow (CVE-ID: CVE-2023-25545)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary. A local administrator can trigger memory corruption and execute arbitrary code on the target system with elevated privileges.
4) Out-of-bounds write (CVE-ID: CVE-2023-22442)
The vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input. A local administrator can trigger an out-of-bounds write and execute arbitrary code on the target system with elevated privileges.
5) Input validation error (CVE-ID: CVE-2023-22379)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to improper input validation. A local administrator can gain unauthorized access to sensitive information on the system.
6) Input validation error (CVE-ID: CVE-2023-25776)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to improper input validation. A local administrator can gain unauthorized access to sensitive information on the system.
7) Double Free (CVE-ID: CVE-2023-28411)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a boundary error. A local administrator can pass specially crafted data to the application, trigger double free error and gain access to sensitive information on the target system.
8) Input validation error (CVE-ID: CVE-2023-25175)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to improper input validation. A local administrator can gain unauthorized access to sensitive information on the system.
9) Out-of-bounds read (CVE-ID: CVE-2023-24475)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition. A local administrator can trigger an out-of-bounds read error and read contents of memory on the system.
10) Integer overflow (CVE-ID: CVE-2023-22443)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow. A local administrator can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.
Remediation
Install update from vendor's website.