Skip to content
OpenAdvisories
High WID-SEC-2024-3418 11 CVEs

Intel Firmware: Mehrere Schwachstellen

Published Nov 12, 2024 · Updated Feb 11, 2025 · Revision 4 · de-DE

Vendor: Dell Vendor: HP Vendor: HPE Vendor: Intel Product: BIOS Product: Computer Product: Firmware Product: PowerScale OneFS Product: ProLiant Product: Synergy

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Intel Firmware ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen.

Product

Die Firmware ist eine in die Geräte fest eingebettete Software, die dort grundlegende Funktionen leistet.

Vulnerabilities 11

  • High 8.2
    CVE-2024-36282

    Improper input validation in the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions ma…

  • High 7.5
    CVE-2024-31154

    Improper input validation in UEFI firmware for some Intel(R) Server S2600BPBR may allow a privileged user to potentiall…

  • High 7.5
    CVE-2024-31158

    Improper input validation in UEFI firmware in some Intel(R) Server Board S2600BP Family may allow a privileged user to …

  • High 7.5
    CVE-2024-39609

    Improper Access Control in UEFI firmware for some Intel(R) Server Board M70KLP may allow a privileged user to potential…

  • High 7.5
    CVE-2024-40885

    Use after free in the UEFI firmware of some Intel(R) Server M20NTP BIOS may allow a privileged user to potentially enab…

  • High 7.5
    CVE-2024-41167

    Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user t…

  • Medium 6.7
    CVE-2024-34167

    Uncontrolled search path for the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions ma…

  • Medium 6.3
    CVE-2024-39811

    Improper input validation in firmware for some Intel(R) Server M20NTP Family UEFI may allow a privileged user to potent…

  • Medium 5.3
    CVE-2024-39285

    Improper access control in UEFI firmware in some Intel(R) Server M20NTP Family may allow a privileged user to potential…

  • Low 3.8
    CVE-2024-25565

    Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated u…

  • Unscored —
    CVE-2022-34301 Public exploit

    A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass …

Revision history

  1. #4

    Neue Updates von Dell und HP aufgenommen

  2. #3

    Neue Updates von HP aufgenommen

  3. #2

    Neue Updates von Dell aufgenommen

  4. #1

    Initiale Fassung

References