Improper Initialization in Intel products - CVE-2024-31157

Vulnerability identifier: #VU104040

CSH Severity: Low

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-31157

CWE-ID: CWE-665

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper initialization in OutOfBandXML module. A local user can gain unauthorized access to sensitive information on the system.

UEFI firmware
4th Generation Intel Xeon Scalable Processors
5th Generation Intel Xeon Scalable processors
Precision 5860 Tower
Precision 7960 Tower
Intel Xeon W2400 processor
Intel Xeon W3400 Processor
openEuler
Fedora
microcode_ctl
Dell Integrated System for Microsoft Azure Stack Hub 16G

Install updates from vendor's website.

microcode_ctl - addressed in versions 2.1-61.6.fc40, 2.1-67.1.fc41
Precision 5860 Tower - update to 2.6.1
Precision 7960 Tower - update to 2.6.1
Dell Integrated System for Microsoft Azure Stack Hub 16G - update to 2502
microcode_ctl - update to 20250211-1

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html

• Multiple vulnerabilities in Intel UEFI Firmware
• Fedora 40 update for microcode_ctl
• Fedora 41 update for microcode_ctl
• openEuler update for microcode_ctl
• Multiple vulnerabilities in Dell Client Platform
• Multiple vulnerabilities in Dell Integrated System