SB20250521139 - Dell Client Platform update for Intel Core Ultra Processor firmware

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20250521139

SB20250521139 - Dell Client Platform update for Intel Core Ultra Processor firmware

Published: May 21, 2025

Security Bulletin ID SB20250521139
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Missing initialization of resource (CVE-ID: CVE-2025-24495)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to incorrect initialization of resource in the branch prediction unit. A local user can gain unauthorized access to sensitive information on the system.


2) Incorrect behavior order (CVE-ID: CVE-2025-20012)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local attacker to gain access to sensitive information on the system. The vulnerability exists due to incorrect behavior order. An attacker with physical access can disclose sensitive information on the target system.

Remediation

Install update from vendor's website.

References