{"uuid": "b316a2dc-662a-4a63-a0d2-a7b0e666b290", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24489", "type": "seen", "source": "https://t.me/hacking_Attack/12177", "content": "Black Hat Ethical Hacking\nIntel Plugs 29 Holes in CPUs, Bluetooth, Security\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Intel Plugs 29 Holes in CPUs, Bluetooth, SecurityPost Views: 61 \nReading Time: 1 Minute\nIntel has unleashed 29 security advisories to plug up some serious bugs in the BIOS firmware for Intel processors, as well as in its Bluetooth products, Active Management Technology tools, the NUC\u00a0Mini PC line, and, ironically, in its own security library.\nDetails about the advisories can be found at Intel\u2019s Product Security Center.\n\nIntel\u2019s senior director of communications, Jerry Bryant, said in a blog post\u00a0on Wednesday that Intel\u2019s mostly digging these security issues up internally \u2013 as in, 95 percent \u2013 through its own diligence, with big chunks of them coming through its bugs bounty program and the company\u2019s own research.\u201cToday we released 29 security advisories\u00a0addressing 73 vulnerabilities,\u201d Bryant wrote. \u201cForty of those, or 55 percent, were found internally through our own proactive security research. Of the remaining 33 CVEs being addressed, 29, or 40 percent, were reported through our bug-bounty program. Overall, 95 percent of the issues being addressed today are the result of our ongoing investments in security assurance, which is consistent with our 2020 Product Security Report.\u201d Pats Itself on the BackThe June patch set from Intel brings its vulnerabilities total to 132 for the first six months of 2021, with 70 percent of those having been discovered and mitigated before they were publicly disclosed, Bryant said.\n\nQuiet, nonpublic discovery and mitigation is a nice turnaround for Intel, Bryant said. He noted that 56 of the 132 issues addressed on Tuesday were found in graphics, networking and Bluetooth components. While issues in those products were mostly found internally by Intel security researchers and product engineers \u2013 at 75 percent \u2013 that wasn\u2019t necessarily the case in its 2019 and 2020 product security reports. In those past few years, a large percentage of issues in these products were found externally and reported through the company\u2019s bug-bounty program.\n\nBryant credited Intel\u2019s Security Development Lifecycle\u00a0(SDL) program for this turnaround. \u201cThrough the SDL, we take learnings from discovered vulnerabilities and make improvements to things like automated code scanning and training as well as using this information to inform our internal Red-Team events,\u201d he described.\nSee Also: RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries The Bad BugsSeveral of the 29 vulnerabilities are rated as high-severity \u2013 including four local privilege escalation vulnerabilities in firmware for Intel\u2019s CPU products; another local privilege escalation vulnerability in Intel Virtualization Technology for Directed I/O (VT-d); a network-exploitable privilege escalation vulnerability in the Intel Security Library; another locally exploitable privilege escalation in the NUC family of computers; yet more in its Driver and Support Assistant (DSA) software and RealSense ID platform; and a denial-of-service (DoS) vulnerability in selected Thunderbolt controllers.\nHere are more details on those high-severity bugs:\n\n* CVE-2021-24489\u00a0Some Intel Virtualization Technology for Directed I/0 (VT-d) products may allow escalation of privilege. The issue is caused by incomplete cleanup in some Intel VT-d products that could enable authenticated attackers to escalate privileges via local access. Rating: High / CVSS 8.8The following four bugs are caused by improper initialization, race condition, improper input validation and insufficient control flow management in the CPU BIO[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:13.376248Z"}