SB2021061712 - Multiple vulnerabilities in Intel CSME, SPS and LMS
Published: June 17, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-24509)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient control flow management in subsystem, which leads to security restrictions bypass and privilege escalation.
2) Race condition (CVE-ID: CVE-2020-8704)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition in subsystem. A local administrator can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
3) Information disclosure (CVE-ID: CVE-2020-24507)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to improper initialization in a subsystem. A local administrator can gain unauthorized access to sensitive information on the system.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-24516)
The vulnerability allows an attacker with physical access to escalate privileges on the system.
The vulnerability exists due to modification of assumed-immutable data in subsystem, which leads to security restrictions bypass and privilege escalation.
5) Buffer overflow (CVE-ID: CVE-2020-8703)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in a subsystem. A local administrator can trigger memory corruption and gain elevated privileges on the target system.
6) Out-of-bounds read (CVE-ID: CVE-2020-24506)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in a subsystem. A local administrator can trigger out-of-bounds read error and read contents of memory on the system.
Remediation
Install update from vendor's website.