SB2023022736 - Multiple vulnerabilities in Intel Battery Life Diagnostic Tool

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Insufficient Control Flow Management (CVE-ID: CVE-2022-36278)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient control flow management, which leads to security restrictions bypass and privilege escalation.

2) Improper Initialization (CVE-ID: CVE-2022-34153)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper initialization. A local user can run a specially crafted application to execute arbitrary code with escalated privileges on the system.

3) Untrusted search path (CVE-ID: CVE-2022-36398)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to uncontrolled search path, which leads to security restrictions bypass and privilege escalation.

Remediation

Install update from vendor's website.

References

• http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00726.html