The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3380 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3380-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     April 01, 2023                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : firmware-nonfree     Version        : 20190114+really20220913-0+deb10u1     CVE ID         : CVE-2020-12362 CVE-2020-12363 CVE-2020-12364 CVE-2020-24586                      CVE-2020-24587 CVE-2020-24588 CVE-2021-23168 CVE-2021-23223                      CVE-2021-37409 CVE-2021-44545 CVE-2022-21181     Debian Bug     : 844056 877667 903437 919452 919632 927286 927917 928510 928631 928672 931930 935969     947356 956224 962972 963025 963558 964028 966025 968272 969000 971791 975726 977042 980101 982579 982757     983255 983561 984489 984852 984874 985740 985743 991500 992551 999825 1006500 1006638 1009316 1009618     1014651 1015728 1016058 1019847 1020962

    The firmware-nonfree package has been updated to include addtional firmware     that may be requested by some drivers in Linux 5.10, availble for Debian LTS as     backported kernel.

    Some of the updated firmware files adresses security vulnerabilities, which may     allow Escalation of Privileges, Denial of Services and Information Disclosures.

    CVE-2020-24586 (INTEL-SA-00473)

        The 802.11 standard that underpins Wi-Fi Protected Access (WPA,         WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require         that received fragments be cleared from memory after (re)connecting         to a network. Under the right circumstances, when another device         sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can         be abused to inject arbitrary network packets and/or exfiltrate user         data.

    CVE-2020-24587  (INTEL-SA-00473)

        The 802.11 standard that underpins Wi-Fi Protected Access (WPA,         WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require         that all fragments of a frame are encrypted under the same key. An         adversary can abuse this to decrypt selected fragments when another         device sends fragmented frames and the WEP, CCMP, or GCMP encryption         key is periodically renewed.

    CVE-2020-24588  (INTEL-SA-00473)

        The 802.11 standard that underpins Wi-Fi Protected Access (WPA,         WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require         that the A-MSDU flag in the plaintext QoS header field is         authenticated. Against devices that support receiving non-SSP A-MSDU         frames (which is mandatory as part of 802.11n), an adversary can         abuse this to inject arbitrary network packets.

    CVE-2021-23168  (INTEL-SA-00621)

        Out of bounds read for some Intel(R) PROSet/Wireless WiFi and         Killer(TM) WiFi products may allow an unauthenticated user to         potentially enable denial of service via adjacent access.

    CVE-2021-23223 (INTEL-SA-00621)

        Improper initialization for some Intel(R) PROSet/Wireless WiFi and         Killer(TM) WiFi products may allow a privileged user to potentially         enable escalation of privilege via local access.

    CVE-2021-37409 (INTEL-SA-00621)

        Improper access control for some Intel(R) PROSet/Wireless WiFi and         Killer(TM) WiFi products may allow a privileged user to potentially         enable escalation of privilege via local access.

    CVE-2021-44545 (INTEL-SA-00621)

        Improper input validation for some Intel(R) PROSet/Wireless WiFi and         Killer(TM) WiFi products may allow an unauthenticated user to         potentially enable denial of service via adjacent access.

    CVE-2022-21181 (INTEL-SA-00621)

        Improper input validation for some Intel(R) PROSet/Wireless WiFi and         Killer(TM) WiFi products may allow a privileged user to potentially         enable escalation of privilege via local access.

    The following advisories are also fixed by this upload, but needs an     updated Linux kernel to load the updated firmware:

    CVE-2020-12362 (INTEL-SA-00438)

        Integer overflow in the firmware for some Intel(R) Graphics Drivers         for Windows * before version 26.20.100.7212 and before Linux kernel         version 5.5 may allow a privileged user to potentially enable an         escalation of privilege via local access.

    CVE-2020-12363 (INTEL-SA-00438)

        Improper input validation in some Intel(R) Graphics Drivers for         Windows* before version 26.20.100.7212 and before Linux kernel         version 5.5 may allow a privileged user to potentially enable a         denial of service via local access.

    CVE-2020-12364 (INTEL-SA-00438)

        Null pointer reference in some Intel(R) Graphics Drivers for         Windows* before version 26.20.100.7212 and before version Linux         kernel version 5.5 may allow a privileged user to potentially enable         a denial of service via local access.

    For Debian 10 buster, these problems have been fixed in version     20190114+really20220913-0+deb10u1.

    We recommend that you upgrade your firmware-nonfree packages.

    For the detailed security status of firmware-nonfree please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firmware-nonfree

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3380 : firmware-adi - security update

high Nessus Plugin ID 173776

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Jan 22, 2025, 5:44 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221744
Version 1.2 Apr 19, 2023, 2:07 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploit available" set to "True". "Exploit available" set to "True". "Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202304191407
Version 1.1 Apr 5, 2023, 10:04 PM Regenerated based on advisory update Plugin Feed: 202304052204
Version 1.0 Apr 2, 2023, 1:54 PM New Plugin Feed: 202304021354