SK-CERT Bezpečnostné varovanie V20240523-01

Dôležitosť	Kritická
Klasifikácia	Neutajované/TLP:CLEAR
CVSS Skóre	10.0

Identifikátor

Intel produkty – kritická bezpečnostná zraniteľnosť

Popis

Spoločnosť Intel vydala bezpečnostné aktualizácie na svoje portfólio produktov, ktoré opravujú viacero bezpečnostných zraniteľností, z ktorých jedna je označená ako kritická. Kritická bezpečnostná zraniteľnosť s identifikátorom CVE-2024-22476 sa nachádza v produkte Intel Neural Compressor, spočíva v nedostatočnom overovaní používateľských vstupov a umožňuje vzdialenému, neautentifikovanému útočníkovi eskalovať svoje privilégiá a následne získať neoprávnený prístup k citlivým údajom, vykonať neoprávnené zmeny v systéme a spôsobiť zneprístupnenie služby. Zneužitím ostatných bezpečnostných zraniteľností možno eskalovať svoje privilégiá a vykonať škodlivý kód s následkom úplného narušenia dôvernosti, integrity a dostupnosti systému.

Dátum prvého zverejnenia varovania

14.5.2024

CVE

CVE-2024-22476, CVE-2024-21792, CVE-2024-21823, CVE-2024-22382, CVE-2024-23487, CVE-2024-24981, CVE-2024-23980, CVE-2024-22095, CVE-2023-22662, CVE-2024-21831, CVE-2024-21861, CVE-2024-21788, CVE-2024-21835, CVE-2024-21843, CVE-2024-21828, CVE-2024-21837, CVE-2024-21809, CVE-2024-21777, CVE-2024-21862, CVE-2024-21774, CVE-2024-21864, CVE-2023-46103, CVE-2023-45733, CVE-2023-49614, CVE-2024-22390, CVE-2024-21772, CVE-2024-22379, CVE-2024-21841, CVE-2023-47165, CVE-2023-38654, CVE-2023-47859, CVE-2023-47210, CVE-2023-45845, CVE-2023-38417, CVE-2023-40536, CVE-2023-45217, CVE-2023-40070, CVE-2023-46689, CVE-2023-38581, CVE-2023-42773, CVE-2023-46691, CVE-2023-45736, CVE-2023-45846, CVE-2023-45315, CVE-2023-41234, CVE-2023-38420, CVE-2023-45745, CVE-2023-47855, CVE-2024-21818, CVE-2023-45320, CVE-2024-21814, CVE-2023-45743, CVE-2023-40155, CVE-2023-43487, CVE-2023-39433, CVE-2023-41082, CVE-2023-29165, CVE-2023-27305, CVE-2023-25952, CVE-2022-42879, CVE-2023-43745, CVE-2023-39929, CVE-2023-41092, CVE-2024-22015, CVE-2024-21813, CVE-2024-22384, CVE-2023-42433, CVE-2023-42668, CVE-2023-43751, CVE-2023-48368, CVE-2023-45221, CVE-2023-22656, CVE-2023-47282, CVE-2023-48727, CVE-2023-47169, CVE-2022-37410, CVE-2023-24460, CVE-2023-43748, CVE-2023-43629, CVE-2023-40071, CVE-2023-41961, CVE-2023-35192, CVE-2023-28402, CVE-2023-27504, CVE-2023-28383, CVE-2021-33141, CVE-2021-33162, CVE-2021-33157, CVE-2021-33161, CVE-2022-37341, CVE-2021-33145, CVE-2021-33158, CVE-2021-33142, CVE-2021-33146

IOC

–

Zasiahnuté systémy

Intel® Neural Compressor Software Intel® DSA and Intel® IAA Intel® Server Products UEFI Firmware Intel® Processor Diagnostic Tool Intel® GPA Framework Software Intel® XTU Software Intel® Computing Improvement Program Software Intel® Ethernet Controller Administrative Tools Installer Software Intel® Quartus Prime Software Intel® Processor Identification Utility Software Intel® Arc™ & Iris® Xe Graphics Software Intel® Core™ Ultra Processor 2024.2 IPU – Intel® Processor Intel® FPGA Firmware Intel® Advisor Software Intel® Inspector Software Intel® Distribution for GDB Software Intel® Data Center GPU Max Series Intel® PROSet/Wireless WiFi and Bluetooth® Intel® Power Gadget Software Intel® TDX Module Software Intel® PCM Software Intel® VTune™ Profiler Intel® Chipset Device Software Intel® DSA Software Uninstaller Intel® CST Software Intel® Arc™ Control Software Intel® CBI Software Libva Library Intel® FPGA Firmware Intel® DLB Driver Intel® DTT Software Installer Intel® Trace Analyzer and Collector Software Endurance Gaming Mode Software Intel® Server Board Onboard Video Driver Intel® Graphics Command Center Service Software Intel® Media SDK and Intel® oneVPL Software Intel® Thunderbolt Driver Intel® GPA Software Intel® BIOS Guard and PPAM Firmware Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Presnú špecifikáciu jednotlivých zasiahnutých produktov nájdete na odkazoch v sekcii ZDROJE

Následky

Vykonanie škodlivého kódu Eskalácia privilégií Neoprávnený prístup k citlivým údajom Neoprávnená zmena v systéme Zneprístupnenie služby

Odporúčania

Administrátorom a používateľom odporúčame bezodkladne vykonať aktualizáciu zasiahnutých systémov. Po odstránení zraniteľností, ktoré mohli spôsobiť vzdialené vykonanie kódu, je dobrou praxou kontrola systému a zmena všetkých hesiel a kľúčov na dotknutom systéme a aj na iných systémoch, kde sa používalo rovnaké heslo či kľúč. SK-CERT administrátorom odporúča venovať osobitnú pozornosť aktualizácii firmvéru, nie len aplikačnému softvéru.

Zdroje

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01109.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01084.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01069.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01067.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01066.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01059.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01056.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01055.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01054.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01053.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01050.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01047.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01043.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01042.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01041.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01039.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01037.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01035.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01034.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01032.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01031.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01021.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01020.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01013.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01012.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01007.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00996.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00984.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00983.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00965.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00962.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00937.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00916.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00831.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00814.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html https://www.securityweek.com/intel-publishes-41-security-advisories-for-over-90-vulnerabilities/ https://exchange.xforce.ibmcloud.com/vulnerabilities/290508

« Späť na zoznam