SecuriTricks - CVE-2024-21807

Description

Improper initialization in the Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

Product(s) Impacted

Product	Versions
Linux kernel	['before version 28.3']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

CWE-665

Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00918.html

CVSS Score

8.8 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: LOW
Scope: CHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

View Vector String

Timeline

Published: Aug. 14, 2024, 2:15 p.m.
Last Modified: Aug. 14, 2024, 5:49 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secure@intel.com

CVE-2024-21807