Input validation error in Intel products - CVE-2024-28047

Vulnerability identifier: #VU104041

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-28047

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: Intel

Affected software:
UEFI firmware
Intel Xeon D Processors
3rd Generation Intel Xeon Scalable Processors
4th Generation Intel Xeon Scalable Processors
5th Generation Intel Xeon Scalable processors
2nd Generation Intel Xeon Scalable Processors
1st Gen Intel Xeon Scalable processor
Intel Xeon Processor W 3100
Intel Xeon W processor 2200
Intel Core X-series Processors
Intel Xeon Processor W 2100
Intel Atom Processor C5000
Intel Atom Processor P5000 Series
Intel Xeon W2400 processor
Intel Xeon W3400 Processor

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input. A local administrator can gain unauthorized access to sensitive information on the system.

Install updates from vendor's website.

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html