Intel Security CenterINTEL:INTEL-SA-00621Intel® PROSet/Wireless WiFi and Killer™ WiFi Advisory
Summary:
Potential security vulnerabilities in some Intel® PROSet/Wireless WiFi and Killer™ WiFi products may allow escalation of privilege, information disclosure or denial of service.** **Intel is releasing firmware and software updates to mitigate these potential vulnerabilities.
Vulnerability Details:
CVEID: CVE-2022-21181
Description: Improper input validation for some Intel® PROSet/Wireless WiFi and Killer™ WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Base Score: 8.2 High
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVEID: CVE-2021-37409
Description: Improper access control for some Intel® PROSet/Wireless WiFi and Killer™ WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Base Score: 8.2 High
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVEID: CVE-2021-23223
Description: Improper initialization for some Intel® PROSet/Wireless WiFi and Killer™ WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Base Score: 8.2 High
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVEID: CVE-2021-23168
Description: Out of bounds read for some Intel® PROSet/Wireless WiFi and Killer™ WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS Base Score: 6.5 Medium
CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVEID: CVE-2021-44545
Description: Improper input validation for some Intel® PROSet/Wireless WiFi and Killer™ WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS Base Score: 6.5 Medium
CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVEID: CVE-2021-26254
Description: Out of bounds read for some Intel® PROSet/Wireless WiFi and Killer™ WiFi products may allow a privileged user to potentially enable denial of service via local access.
CVSS Base Score: 6.0 Medium
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
CVEID: CVE-2022-21172
Description: Out of bounds write for some Intel® PROSet/Wireless WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Base Score: 6.0 Medium
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H__
CVEID: CVE-2022-21240
Description: Out of bounds read for some Intel® PROSet/Wireless WiFi products may allow a privileged user to potentially enable information disclosure via local access.
CVSS Base Score: 6.0 Medium
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CVEID: CVE-2022-21139
Description: Inadequate encryption strength for some Intel® PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CVSS Base Score: 5.4 Medium
CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVEID: CVE-2022-21197
Description: Improper input validation for some Intel® PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Base Score: 5.3 Medium
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVEID: CVE-2022-21160
Description: Improper buffer restrictions for some Intel® PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Base Score: 5.3 Medium
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVEID: CVE-2021-23188
Description: Improper access control for some Intel® PROSet/Wireless WiFi and Killer™ WiFi products may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Base Score: 4.7 Medium
CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVEID: CVE-2022-21212
Description: Improper input validation for some Intel® PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS Base Score: 4.3 Medium
CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVEID: CVE-2022-21140
Description: Improper access control for some Intel® PROSet/Wireless WiFi and Killer™ WiFi products may allow a privileged user to potentially enable information disclosure via local access.
CVSS Base Score: 4.2 Medium
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Affected Products:
Intel® PROSet/Wireless WiFi software before version 22.120, Killer™ WiFi software before version 3.1122.1105 and UEFI version 2.2.12.22071.
CVE ID
|
Affected Products
|
Affected OS
—|—|—
CVE-2022-21181
|
Intel® Dual Band Wireless-AC 8265
Intel® Dual Band Wireless-AC 8260
Intel® Wireless-AC 9560
Intel® Wireless-AC 9462
Intel® Wireless-AC 9461
Intel® Wireless-AC 9260
|
Windows 10 & 11
Linux
Chrome OS
CVE-2022-21181
|
Killer™ Wireless-AC 1550
|
Windows 10 & 11
CVE-2021-23223
|
Intel® Wi-Fi 6E AX411
Intel® Wi-Fi 6E AX211
Intel® Wi-Fi 6E AX210
|
Windows 10 & 11
Linux
Chrome OS
UEFI
CVE-2021-23223
|
Killer™ Wi-Fi 6E AX1690
Killer™ Wi-Fi 6E AX1675
|
Windows 10 & 11
CVE-2021-37409
|
Intel® Wi-Fi 6E AX411
Intel® Wi-Fi 6E AX211
Intel® Wi-Fi 6E AX210
Intel® Wi-Fi 6 AX201
Intel® Wi-Fi 6 AX200
Intel® Wireless-AC 9560
Intel® Wireless-AC 9462
Intel® Wireless-AC 9461
Intel® Wireless-AC 9260
|
Windows 10 & 11
Linux
Chrome OS
UEFI
CVE-2021-37409
|
Killer™ Wi-Fi 6E AX1690
Killer™ Wi-Fi 6E AX1675
Killer™ Wi-Fi 6 AX1650
Killer™ Wireless-AC 1550
|
Windows 10 & 11
CVE-2022-21140, CVE-2021-23188
|
Intel® Wi-Fi 6E AX411
Intel® Wi-Fi 6E AX211
Intel® Wi-Fi 6E AX210
Intel® Wi-Fi 6 AX201
Intel® Wi-Fi 6 AX200
Intel® Wireless-AC 9560
Intel® Wireless-AC 9462
Intel® Wireless-AC 9461
Intel® Wireless-AC 9260
Intel® Dual Band Wireless-AC 3168
Intel® Wireless 7265 (Rev D) Family
Intel® Dual Band Wireless-AC 3165
Intel® Dual Band Wireless-AC 8265
Intel® Dual Band Wireless-AC 8260
|
Windows 10 & 11
CVE-2022-21140, CVE-2021-23188
|
Killer™ Wi-Fi 6E AX1690
Killer™ Wi-Fi 6E AX1675
Killer™ Wi-Fi 6 AX1650
Killer™ Wireless-AC 1550
|
Windows 10 & 11
CVE-2021-26254
|
Intel® Wi-Fi 6E AX411
Intel® Wi-Fi 6E AX211
Intel® Wi-Fi 6E AX210
Intel® Wi-Fi 6 AX201
Intel® Wi-Fi 6 AX200
|
Windows 10 & 11
CVE-2021-26254
|
Killer™ Wi-Fi 6E AX1690
Killer™ Wi-Fi 6E AX1675
Killer™ Wi-Fi 6 AX1650
|
Windows 10 & 11
CVE-2021-23168
|
Intel® Wi-Fi 6E AX411
Intel® Wi-Fi 6E AX211
Intel® Wi-Fi 6E AX210
Intel® Wi-Fi 6 AX201
Intel® Wi-Fi 6 AX200
Intel® Wireless-AC 9560
Intel® Wireless-AC 9462
Intel® Wireless-AC 9461
Intel® Wireless-AC 9260
Intel® Dual Band Wireless-AC 3168
Intel® Wireless 7265 (Rev D) Family
Intel® Dual Band Wireless-AC 3165
Intel® Dual Band Wireless-AC 8265
Intel® Dual Band Wireless-AC 8260
|
Windows 10 & 11
Linux
Chrome OS
CVE-2021-23168
|
Killer™ Wi-Fi 6E AX1690
Killer™ Wi-Fi 6E AX1675
Killer™ Wi-Fi 6 AX1650
Killer™ Wireless-AC 1550
|
Windows 10 & 11
CVE-2021-44545
|
Intel® Wi-Fi 6E AX411
Intel® Wi-Fi 6E AX211
Intel® Wi-Fi 6E AX210
Intel® Wi-Fi 6 AX201
Intel® Wi-Fi 6 AX200
|
Windows 10 & 11
Linux
UEFI
CVE-2021-44545
|
Killer™ Wi-Fi 6E AX1690
Killer™ Wi-Fi 6E AX1675
Killer™ Wi-Fi 6 AX1650
|
Windows 10 & 11
CVE-2022-21212, CVE-2022-21197, CVE-2022-21160, CVE-2022-21139
|
Intel® Wi-Fi 6E AX411
Intel® Wi-Fi 6E AX211
Intel® Wi-Fi 6E AX210
Intel® Wi-Fi 6 AX201
Intel® Wi-Fi 6 AX200
Intel® Wireless-AC 9560
Intel® Wireless-AC 9462
Intel® Wireless-AC 9461
Intel® Wireless-AC 9260
|
UEFI
CVE-2022-21172, CVE-2022-21240
|
Intel® Wi-Fi 6E AX411
Intel® Wi-Fi 6E AX211
Intel® Wi-Fi 6E AX210
|
UEFI
Recommendations:
Windows:
Intel recommends updating Intel® PROSet/Wireless WiFi software to version 22.120 or later.
Updates are available for download at this location:
Intel recommends updating Killer™ WiFi software to version 3.1122.1105 or later.
Updates for Killer™ products are available for download at this location:
<https://www.intel.com/content/www/us/en/download/19779/intel-killer-performance-suite.html>
Important note regarding the mitigation of CVE-2022-21181:
For the below Intel vPro® platforms that have Intel® Active Management Technology (AMT) provisioned and Wireless AMT enabled, the CSME version needs to be updated as well.
Platform
|
CSME Version
|
Device
—|—|—
11th Generation Intel® Core Processor
|
15.0.41
|
Intel® Wireless-AC 9260
9th Generation Intel® Core Processor
|
12.0.90
|
Intel® Wireless-AC 9260
Intel® Wireless-AC 9560
8th Generation Intel® Core Processor
|
12.0.90
|
Intel® Wireless-AC 9260
Intel® Wireless-AC 9560
7th Generation Intel® Core Processor
6th Generation Intel® Core Processor
|
11.8.92 (11.12,11.22 for workstations)
|
Intel® Dual Band Wireless-AC 8265
Intel® Dual Band Wireless-AC 8260
Intel recommends that users of Intel® vPRO® CSME WiFi products update to the latest version provided by the system manufacturer that addresses these issues.
UEFI:
Intel recommends updating Intel® PROSet/Wireless WiFi UEFI drivers to version 2.2.12.22071 or later.
Please contact your OEM support group to obtain the correct driver version.
Chrome OS:
Intel® PROSet/Wireless WiFi drivers to mitigate these vulnerabilities will be up streamed to Chromium by August 09, 2022.
For any Google Chrome OS solution and schedule, please contact Google directly.
Linux OS:
Intel® PROSet/Wireless WiFi drivers to mitigate these vulnerabilities will be up streamed by August 09, 2022.
Consult the regular opensource channels to obtain this update.
Acknowledgements:
Intel would like to thank Nicholas Iooss and Gabriel Campana of Ledger Donjon for reporting CVE-2022-21181. The remaining issues were found internally by Intel employees.
Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.
Related
