DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Intel BIOS: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-02-08
Ein lokaler Angreifer kann mehrere Schwachstellen in Intel BIOS, HPE Proliant, HPE Synergy sowie Lenovo Computer ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service Zustand herbeizuführen.
01
beschreibt (16)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-0156US | high7.8 | — | ||
Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable an escalation of privilege via local access. | ||||
| CVE-2021-0125US | medium6.6 | — | ||
Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical access. | ||||
| CVE-2021-0124US | medium6.6 | — | ||
Improper access control in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical access. | ||||
| CVE-2021-0119US | medium6.2 | — | ||
Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical access. | ||||
| CVE-2021-0118US | medium6.7 | — | ||
Out-of-bounds read in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access. | ||||
| CVE-2021-0117US | high7.8 | — | ||
Pointer issues in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access. | ||||
| CVE-2021-0116US | high7.8 | — | ||
Out-of-bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access. | ||||
| CVE-2021-0115US | medium6.7 | — | ||
Buffer overflow in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. | ||||
| CVE-2021-0111US | medium6.7 | — | ||
NULL pointer dereference in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access. | ||||
| CVE-2021-0107US | medium6.7 | — | ||
Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. | ||||
| CVE-2021-0103US | medium6.7 | — | ||
Insufficient control flow management in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access. | ||||
| CVE-2021-0099US | high7.8 | — | ||
Insufficient control flow management in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable an escalation of privilege via local access. | ||||
| CVE-2021-0093US | medium4.4OT erhöht | — | ||
Incorrect default permissions in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access. | ||||
| CVE-2021-0092US | medium4.4 | — | ||
Improper access control in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access. | ||||
| CVE-2021-0091US | high7.8 | — | ||
Improper access control in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable an escalation of privilege via local access. | ||||
| CVE-2021-0114US | medium6.7OT erhöht | — | ||
Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- NetApp Security Advisory NTAP-20220210-0007 vom 2022-02-11external
- HPE SECURITY BULLETIN vom 2022-02-08external
- HPE Security Bulletinexternal
- Lenovo Security Advisory vom 2022-02-08external
- WID-SEC-W-2022-2225 - CSAF Versionself
- WID-SEC-2022-2225 - Portal Versionself
- IBM Security Bulletin 6845359 vom 2022-12-06external
- Intel Security Advisory: INTEL-SA-00527 vom 2022-02-08external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan