Intel® Wireless Bluetooth® Advisory

Summary:

Potential security vulnerabilities in some Intel® Wireless Bluetooth® products may allow escalation of privilege or denial of service.** **Intel is releasing firmware and software updates to mitigate these potential vulnerabilities.

Vulnerability Details:

CVEID: CVE-2020-12321

Description: Improper buffer restriction in some Intel® Wireless Bluetooth® products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

CVSS Base Score: 9.6 Critical

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2020-12322

Description: Improper input validation in some Intel® Wireless Bluetooth® products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

CVSS Base Score: 6.5 Medium

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

Intel® Wireless Bluetooth® products:

Intel® Wi-Fi 6 AX201
Intel® Wi-Fi 6 AX200
Intel® Wireless-AC 9560
Intel® Wireless-AC 9462
Intel® Wireless-AC 9461
Intel® Wireless-AC 9260
Intel® Dual Band Wireless-AC 8265
Intel® Dual Band Wireless-AC 8260
Intel® Dual Band Wireless-AC 3168
Intel® Wireless 7265 (Rev D) Family
Intel® Dual Band Wireless-AC 3165

Recommendations:

Intel recommends updating affected Intel® Wireless Bluetooth® products to version 21.110 or later.

Windows OS:*

For Windows* 10, updates are available for download at this location:

<https://www.intel.com/content/www/us/en/support.html&gt;

Customers can also download the latest available firmware from the Intel Customer Support site here.

Linux OS:

Only CVE-2020-12321 impacts Linux. This CVE is addressed in the Intel® Wireless Bluetooth® firmware version 21.110 for Linux.

Intel® Wireless Bluetooth® firmware to mitigate these vulnerabilities have been up streamed to Linux before November 10th, 2020.

Consult the regular Open Source channels to obtain this update.

Chrome OS:

Only CVE-2020-12321 impacts Chrome OS. This CVE is addressed in the Intel® Wireless Bluetooth® firmware version 21.110 for Chromium.

Intel® Wireless Bluetooth® firmware to mitigate these vulnerabilities have been up streamed to Chromium.

For any Google Chrome OS solution and schedule, please contact Google directly.

Acknowledgements:

Intel would like to thank Denis Straghkov at the Institute for System Programming. V.P. Ivannikov RAS for reporting CVE-2020-12321 and the researchers at Singapore University of Technology and Design for reporting CVE-2020-12322.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.