Intel Tiber Edge Platform Edge Orchestrator Security Advisory: Multiple CVEs (Privilege Escalation, Info Disclosure, DoS)

Key Information Vulnerability Overview Intel ID: INTEL-SA-01236 Advisory Category: Software Impact: Privilege Escalation, Denial of Service, Information Disclosure Severity Rating: High Vulnerability Details CVE-2023-22447: Due to improper permission assignment, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow an authenticated user to potentially enable privilege escalation via local access. CVE-2023-22452: Due to insufficient control flow management, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow a privileged user to potentially enable information disclosure via adjacent access. CVE-2023-22454: For certain Edge Orchestrator software for Intel® Tiber™ Edge Platform, unauthorized exposure of sensitive information may allow an authenticated user to potentially enable information disclosure via adjacent access. CVE-2023-22456: Due to uncontrolled resource consumption, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access. CVE-2023-22458: Due to improper permission assignment, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow an authenticated user to potentially enable privilege escalation via adjacent access. CVE-2023-22460: For certain Edge Orchestrator software for Intel® Tiber™ Edge Platform, unauthorized exposure of sensitive information may allow an authenticated user to potentially enable information disclosure via local access. CVE-2023-22463: Due to protection mechanism failure, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow an authenticated user to potentially enable privilege escalation via adjacent access. CVE-2023-22464: Due to insufficient encryption strength, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow an authenticated user to potentially enable privilege escalation via adjacent access. CVE-2023-22466: Due to improper permission assignment, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow an unauthenticated user to potentially enable information disclosure via adjacent access. CVE-2023-22468: Due to uncontrolled resource consumption, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow an unauthenticated user to potentially enable denial of service via adjacent access. CVE-2023-22470: Due to protection mechanism failure, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow an authenticated user to potentially enable privilege escalation via adjacent access. CVE-2023-22472: Due to improper condition checking, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access. CVE-2023-22474: Due to improper permission assignment, certain Edge Orchestrator software for Intel® Tiber™ Edge Platform may allow an authenticated user to potentially enable privilege escalation via adjacent access. CVE-2023-22476: For certain Edge Orchestrator software for Intel® Tiber™ Edge Platform, unauthorized exposure of sensitive information may allow an authenticated user to potentially enable information disclosure via adjacent access. Affected Products Edge Orchestrator software for Intel® Tiber™ Edge Platform versions prior to 24.11. Recommendations Intel recommends updating Edge Orchestrator software to version 24.11 or later for Intel® Tiber™ Edge Platform. The update can be downloaded from: https://wiki.intel.com/content/www/us/en/security/advisory/confidential/tools/edge-orchestrator-on-prem-deployment-guide.html Intel recommends updating Edge Orchestrator software on-prem to version 24.11 or later for Intel® Tiber™ Edge Platform. The update can be downloaded from: https://wiki.intel.com/content/www/us/en/security/advisory/confidential/tools/edge-orchestrator-on-prem-deployment-guide.html

Goal Reached Thanks to every supporter — we hit 100%!

Intel Tiber Edge Platform Edge Orchestrator Security Advisory: Multiple CVEs (Privilege Escalation, Info Disclosure, DoS)