Bugzilla – Bug 1178872
VUL-0: CVE-2020-12313,CVE-2020-12317,CVE-2020-12319,CVE-2017-13080: kernel-firmware: Intel WiFi firmware update
Last modified: 2022-08-24 08:37:46 UTC
CVE-2020-12313 Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12313 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12313 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00402 CVE-2020-12317 Improper buffer restriction in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12317 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12317 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00402 CVE-2020-12319 Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12319 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12319 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00402 CVE-2017-13080 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13080 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13080 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00402
CVE-2017-13080 is already fixed in our kernels. I assume this WiFi firmware update provides a redundant fix.
Sorry, I overlooked this bug entry. Don't we need any driver side fixes? The details seem missing...
Takashi, is there anything that could be done here or do we just close the bug?
IMO, this is a WONTFIX bug. If we ever get more details for the needed fix, we can take that, but it's pretty unlikely.
Reassigned back to security team. The iwlwifi firmware files have been updated for other CVE entries already, and there is no other change needed, as it seems.
Hi Takashi, would it be possible to update ibt-hw to ibt-hw-37.8.10-fw-22.50.19.14.f.bseq on SUSE:SLE-11-SP3:Update?
(In reply to Thomas Leroy from comment #8) > Hi Takashi, would it be possible to update ibt-hw to > ibt-hw-37.8.10-fw-22.50.19.14.f.bseq on SUSE:SLE-11-SP3:Update? The update is pending for bsc#913459 over 6 years. Can it be merged at first?
(In reply to Takashi Iwai from comment #9) > (In reply to Thomas Leroy from comment #8) > > Hi Takashi, would it be possible to update ibt-hw to > > ibt-hw-37.8.10-fw-22.50.19.14.f.bseq on SUSE:SLE-11-SP3:Update? > > The update is pending for bsc#913459 over 6 years. Can it be merged at > first? It seems that the corresponding IBS incident SUSE:Maintenance:1251 has been removed. It's likely that we will need a new submission for bsc#913459... I can't see why the incident has been removed, so I would say let's wait for Marcus to potentially give further information there. If we need a new submission for bsc#913459, let's just mention these CVEs in the changes file.
I checked the SLE11-SP3-LTSS kernel code, and this (3.0-based) kernel doesn't support Intel BT patching at all. So firmware is useless there. Reassigned back.
(In reply to Takashi Iwai from comment #11) > I checked the SLE11-SP3-LTSS kernel code, and this (3.0-based) kernel > doesn't support Intel BT patching at all. So firmware is useless there. > > Reassigned back. Thanks for checking Takashi. Setting 11sp3 as not affected and closing