Insufficient Control Flow Management in Intel products - CVE-2024-25565

Vulnerability identifier: #VU100417

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-25565

CWE-ID: CWE-691

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient control flow management. A local attacker can perform a denial of service (DoS) attack.

UEFI firmware
Intel 4th Generation Intel Xeon Scalable Processors
Intel 5th Generation Intel Xeon Scalable Processors
Precision 5860 Tower
Precision 7960 Tower
Precision 7960 XL Rack
HPE ProLiant DL360 Gen11 Server
HPE Compute Edge Server e930t
HPE Synergy 480 Gen11 Compute Module
HPE ProLiant ML350 Gen11 Server
HPE ProLiant ML110 Gen11
HPE ProLiant DL560 Gen11
HPE ProLiant DL380a Gen11
HPE ProLiant DL380 Gen11 Server
HPE ProLiant DL320 Gen11 Server
HPE ProLiant DL110 Gen11
HPE Alletra 4140
HPE Alletra 4120
HPE Alletra 4110
HPE SimpliVity 380 Gen11
APEX Cloud Platform for Microsoft Azure
Precision 7960 Rack
Dell EMC VxRail Appliance
Dell Data Lakehouse
APEX Cloud Platform for Red Hat OpenShift

Install updates from vendor's website.

APEX Cloud Platform for Microsoft Azure - update to 01.04.00.00
Dell EMC VxRail Appliance - update to 7.0.540
Dell Data Lakehouse - update to 1.4.0.0
Precision 5860 Tower - update to 2.4.1
Precision 7960 Tower - update to 2.4.1
Precision 7960 Rack - update to 2.4.4
Precision 7960 XL Rack - update to 2.4.4
HPE ProLiant DL360 Gen11 Server - update to 2.30_08-09-2024
HPE Compute Edge Server e930t - update to 2.30_08-09-2024
HPE Synergy 480 Gen11 Compute Module - update to 2.30_08-09-2024
HPE ProLiant ML350 Gen11 Server - update to 2.30_08-09-2024
HPE ProLiant ML110 Gen11 - update to 2.30_08-09-2024
HPE ProLiant DL560 Gen11 - update to 2.30_08-09-2024
HPE ProLiant DL380a Gen11 - update to 2.30_08-09-2024
HPE ProLiant DL380 Gen11 Server - update to 2.30_08-09-2024
HPE ProLiant DL320 Gen11 Server - update to 2.30_08-09-2024
HPE ProLiant DL110 Gen11 - update to 2.30_08-09-2024
HPE Alletra 4140 - update to 2.30_08-09-2024
HPE Alletra 4120 - update to 2.30_08-09-2024
HPE Alletra 4110 - update to 2.30_08-09-2024
APEX Cloud Platform for Red Hat OpenShift - update to 03.03.00.00
HPE SimpliVity 380 Gen11 - update to 2024_1129

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01085.html

• Denial of service in Intel UEFI Firmware
• HPE SimpliVity 380 Gen11 update for Intel UEFI firmware
• Multiple vulnerabilities in Dell APEX Cloud Platform for Red Hat OpenShift
• Multiple vulnerabilities in Dell Precision Rack BIOS
• Multiple vulnerabilities in Dell Client Platform for Intel Xeon Processor with Intel SGX and UPLR2
• Insufficient Control Flow Management in Certain HPE ProLiant DL/ML, Alletra, Synergy, and Edgeline Servers Using Certain Intel Processors
• Dell VxRail Appliance 7.x update for third-party components
• APEX Cloud Platform for Microsoft Azure update for third-party components
• Dell Data Lakehouse update for third-party components