Debian DLA-3380-1 : firmware-nonfree - LTS security update

high Nessus Plugin ID 173776

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3380 advisory.

- Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access. (CVE-2020-12362)

- Improper input validation in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access. (CVE-2020-12363)

- Null pointer reference in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before version Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access. (CVE-2020-12364)

- The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
(CVE-2020-24586)

- The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

- The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

- Out of bounds read for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access. (CVE-2021-23168)

- Improper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2021-23223)

- Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2021-37409)

- Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access. (CVE-2021-44545)

- Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2022-21181)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the firmware-nonfree packages.

For Debian 10 buster, these problems have been fixed in version 20190114+really20220913-0+deb10u1.

Plugin Details

Severity: High

ID: 173776

File Name: debian_DLA-3380.nasl

Version: 1.2

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 4/2/2023

Updated: 4/19/2023

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-12362

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS Score Source: CVE-2022-21181

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:firmware-cavium, p-cpe:/a:debian:debian_linux:firmware-qlogic, p-cpe:/a:debian:debian_linux:firmware-ivtv, p-cpe:/a:debian:debian_linux:firmware-myricom, p-cpe:/a:debian:debian_linux:firmware-adi, p-cpe:/a:debian:debian_linux:firmware-amd-graphics, p-cpe:/a:debian:debian_linux:firmware-netronome, p-cpe:/a:debian:debian_linux:firmware-linux, p-cpe:/a:debian:debian_linux:firmware-ipw2x00, p-cpe:/a:debian:debian_linux:firmware-brcm80211, p-cpe:/a:debian:debian_linux:firmware-siano, p-cpe:/a:debian:debian_linux:firmware-libertas, cpe:/o:debian:debian_linux:10.0, p-cpe:/a:debian:debian_linux:firmware-iwlwifi, p-cpe:/a:debian:debian_linux:firmware-bnx2x, p-cpe:/a:debian:debian_linux:firmware-qcom-media, p-cpe:/a:debian:debian_linux:firmware-linux-nonfree, p-cpe:/a:debian:debian_linux:firmware-ralink, p-cpe:/a:debian:debian_linux:firmware-samsung, p-cpe:/a:debian:debian_linux:firmware-intelwimax, p-cpe:/a:debian:debian_linux:firmware-ti-connectivity, p-cpe:/a:debian:debian_linux:firmware-atheros, p-cpe:/a:debian:debian_linux:firmware-misc-nonfree, p-cpe:/a:debian:debian_linux:firmware-netxen, p-cpe:/a:debian:debian_linux:firmware-bnx2, p-cpe:/a:debian:debian_linux:firmware-realtek, p-cpe:/a:debian:debian_linux:firmware-intel-sound

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/1/2023

Vulnerability Publication Date: 2/17/2021

Reference Information

CVE: CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-24586, CVE-2020-24587, CVE-2020-24588, CVE-2021-23168, CVE-2021-23223, CVE-2021-37409, CVE-2021-44545, CVE-2022-21181

Detections

Analytics