Input validation error in Intel products - CVE-2024-29214

Vulnerability identifier: #VU104037

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-29214

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in CseVariableStorageSmm. A local administrator can pass specially crafted input to the application and gain elevated privileges.

UEFI firmware
Intel Pentium Processor Silver Series
Intel Celeron Processor J Series
Intel Celeron Processor N Series
Wyse 5470
Wyse 5470 All-In-One
Wyse 5070
Latitude 3190
Latitude 3190 2-In-1
openEuler
Fedora
microcode_ctl

Install updates from vendor's website.

Wyse 5470 - update to 1.28.0
Wyse 5470 All-In-One - update to 1.29.0
Wyse 5070 - update to 1.34.0
Latitude 3190 - update to 1.37.0
Latitude 3190 2-In-1 - update to 1.37.0
microcode_ctl - addressed in versions 2.1-61.6.fc40, 2.1-67.1.fc41
microcode_ctl - update to 20250211-1

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html

• Multiple vulnerabilities in Intel UEFI Firmware
• Fedora 40 update for microcode_ctl
• Fedora 41 update for microcode_ctl
• openEuler update for microcode_ctl
• Multiple vulnerabilities in Dell Client Platform