Intel® Wireless Bluetooth® and Killer™ Bluetooth® Advisory

Summary:

Potential security vulnerabilities in Intel® Wireless Bluetooth® products and Killer™ Bluetooth® products may allow information disclosure. Intel is releasing firmware updates to mitigate these potential vulnerabilities.

Vulnerability Details:

CVEID: CVE-2020-26555 (Non-Intel issued)

Intel Description (official wording not yet available): Improper access control in some Intel® Wireless Bluetooth® products in multiple operating systems and Killer™ Bluetooth® products in Windows 10 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.

CVSS Base Score: 5.4 Medium

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVEID: CVE-2020-26558 (Non-Intel issued)

Intel Description (official wording not yet available): Improper authentication in some Intel® Wireless Bluetooth® products in multiple operating systems and Killer™ Bluetooth® products in Windows 10 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.

CVSS Base Score: 4.6 Medium

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Products:

Intel® Wireless Bluetooth® products:

Intel® Wi-Fi 6 AX210

Intel® Wi-Fi 6 AX201

Intel® Wi-Fi 6 AX200

Intel® Wireless-AC 9560

Intel® Wireless-AC 9462

Intel® Wireless-AC 9461

Intel® Wireless-AC 9260

Intel® Dual Band Wireless-AC 8265

Intel® Dual Band Wireless-AC 8260

Intel® Dual Band Wireless-AC 3168

Intel® Wireless 7265 (Rev D) Family

Intel® Dual Band Wireless-AC 3165

Killer™ Bluetooth® products:

Killer™ Wi-Fi 6E AX1675

Killer™ Wi-Fi 6 AX1650

Killer™ Wireless-AC 1550

Recommendation:

Windows OS:*

Intel recommends updating affected Intel® Wireless Bluetooth® and Killer™ Bluetooth® products to version 22.50 or later.

For Windows* 10, updates are available for download at this location:

<https://www.intel.com/content/www/us/en/support.html&gt;

Customers can also download the latest available firmware from the Intel Customer Support site here.

Updates for Killer™ drivers with Windows 10 are available for download at this location: <https://www.intel.com/content/www/us/en/secure/design/confidential/products-and-solutions/wireless-and-modems/wireless-software/killer-performance-suite.html&gt;

Linux OS:

Intel® Wireless Bluetooth® firmware to mitigate these vulnerabilities will be up streamed to Linux before May 23rd, 2021.

Consult the regular Open Source channels to obtain this update.

---

Chrome OS:

Intel® Wireless Bluetooth® firmware to mitigate these vulnerabilities will be up streamed to Chromium.

For any Google Chrome OS solution and schedule, please contact Google directly.

Acknowledgements:

These issues were found externally.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.