SB2024081939 - Multiple vulnerabilities in Intel Ethernet controllers and adapters
Published: August 19, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2024-21810)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input in the Linux kernel mode driver for some Intel Ethernet Network Controllers and Adapters. A local user can execute arbitrary code with escalated privileges.
2) Input validation error (CVE-ID: CVE-2024-24983)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.
3) Out-of-bounds write (CVE-ID: CVE-2024-23497)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
4) Integer overflow (CVE-ID: CVE-2024-23981)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error. A local user can trigger ab integer overflow and execute arbitrary code with elevated privileges.
5) Improper access control (CVE-ID: CVE-2024-24986)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper access restrictions. A local user can execute arbitrary code with elevated privileges.
6) Input validation error (CVE-ID: CVE-2024-23499)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the system and perform a denial of service (DoS) attack.
7) Improper Initialization (CVE-ID: CVE-2024-21807)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper initialization. A local user can run a specially crafted application to execute arbitrary code with escalated privileges on the system.
8) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2024-21806)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper error handling in Linux kernel mode driver. A local user can perform a denial of service (DoS) attack.
9) Untrusted search path (CVE-ID: CVE-2024-21769)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to usage of an untrusted search path in some Intel(R) Ethernet Connection I219-LM install software. A local user can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.
Remediation
Install update from vendor's website.