Input validation error in Intel products - CVE-2024-28047

Vulnerability identifier: #VU104041

CSH Severity: Low

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-28047

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input. A local administrator can gain unauthorized access to sensitive information on the system.

UEFI firmware
Intel Xeon D Processors
3rd Generation Intel Xeon Scalable Processors
4th Generation Intel Xeon Scalable Processors
5th Generation Intel Xeon Scalable processors
2nd Generation Intel Xeon Scalable Processors
1st Gen Intel Xeon Scalable processor
Intel Xeon Processor W 3100
Intel Xeon W processor 2200
Intel Core X-series Processors
Intel Xeon Processor W 2100
Intel Atom Processor C5000
Intel Atom Processor P5000 Series
PowerEdge XE9640
PowerEdge T560
PowerEdge R760xa
PowerEdge XE9680
PowerEdge XR5610
PowerEdge XR8610t
PowerEdge XR8620t
PowerEdge XR7620
PowerEdge XE8640
PowerEdge R760xd2
DSS 8440
PowerEdge XE2420
PowerEdge XE7420
PowerEdge XE7440
Dell XC Core XC660
Dell XC Core XC760
Dell XC Core XC660xs
Dell XC Core XC760xa
PowerEdge R760xs
PowerEdge R660
PowerEdge R760
PowerEdge C6620
PowerEdge MX760c
PowerEdge R860
PowerEdge R960
PowerEdge HS5610
PowerEdge HS5620
PowerEdge R660xs
PowerEdge R350
PowerEdge R250
PowerEdge T350
PowerEdge T150
PowerEdge R650XS
Dell EMC XC Core XC450
Dell EMC XC Core XC650
PowerEdge XR12
PowerEdge XR11
PowerEdge T550
PowerEdge R750XS
PowerEdge R450
PowerEdge R550
PowerEdge MX750c
PowerEdge C6520
PowerEdge R750XA
PowerEdge R750
PowerEdge R650
Dell EMC XC Core XC750
Dell EMC XC Core XC750xa
Dell EMC XC Core XC6520
PowerEdge XR4510c
PowerEdge XR4520c
Precision 5860 Tower
Precision 7960 Tower
PowerEdge R940
Dell EMC XC Core XCXR2
Dell EMC XC Core XC940 System
Dell EMC XC Core XC740xd2
Dell EMC XC Core XC740xd System
Dell EMC XC Core XC640 System
Dell EMC XC Core 6420 System
PowerEdge R740
PowerEdge R740XD
Dell EMC Storage NX3340
Dell EMC Storage NX3240
PowerEdge C4140
PowerEdge MX840C
PowerEdge M640 (for PE VRTX)
PowerEdge M640
PowerEdge FC640
PowerEdge C6420
PowerEdge T640
PowerEdge R940XA
PowerEdge R840
PowerEdge MX740C
PowerEdge R740XD2
PowerEdge XR2
PowerEdge T440
PowerEdge R440
PowerEdge R540
PowerEdge R640
Intel Xeon W2400 processor
Intel Xeon W3400 Processor
openEuler
Fedora
APEX Cloud Platform for Microsoft Azure
microcode_ctl
APEX Cloud Platform for Red Hat OpenShift
Dell Integrated System for Microsoft Azure Stack Hub 16G

Install updates from vendor's website.

APEX Cloud Platform for Microsoft Azure - update to 01.05.01.00
PowerEdge R350 - update to 1.11.1
PowerEdge R250 - update to 1.11.1
PowerEdge T350 - update to 1.11.1
PowerEdge T150 - update to 1.11.1
PowerEdge R650XS - update to 1.16.2
Dell EMC XC Core XC450 - update to 1.16.2
Dell EMC XC Core XC650 - update to 1.16.2
PowerEdge XR12 - update to 1.16.2
PowerEdge XR11 - update to 1.16.2
PowerEdge T550 - update to 1.16.2
PowerEdge R750XS - update to 1.16.2
PowerEdge R450 - update to 1.16.2
PowerEdge R550 - update to 1.16.2
PowerEdge MX750c - update to 1.16.2
PowerEdge C6520 - update to 1.16.2
PowerEdge R750XA - update to 1.16.2
PowerEdge R750 - update to 1.16.2
PowerEdge R650 - update to 1.16.2
Dell EMC XC Core XC750 - update to 1.16.2
Dell EMC XC Core XC750xa - update to 1.16.2
Dell EMC XC Core XC6520 - update to 1.16.2
PowerEdge XR4510c - update to 1.17.3
PowerEdge XR4520c - update to 1.17.3
microcode_ctl - addressed in versions 2.1-61.6.fc40, 2.1-67.1.fc41
Precision 5860 Tower - update to 2.6.1
Precision 7960 Tower - update to 2.6.1
PowerEdge R940 - update to 2.23.0
Dell EMC XC Core XCXR2 - update to 2.23.0
Dell EMC XC Core XC940 System - update to 2.23.0
Dell EMC XC Core XC740xd2 - update to 2.23.0
Dell EMC XC Core XC740xd System - update to 2.23.0
Dell EMC XC Core XC640 System - update to 2.23.0
Dell EMC XC Core 6420 System - update to 2.23.0
PowerEdge R740 - update to 2.23.0
PowerEdge R740XD - update to 2.23.0
Dell EMC Storage NX3340 - update to 2.23.0
Dell EMC Storage NX3240 - update to 2.23.0
PowerEdge C4140 - update to 2.23.0
PowerEdge MX840C - update to 2.23.0
PowerEdge M640 (for PE VRTX) - update to 2.23.0
PowerEdge M640 - update to 2.23.0
PowerEdge FC640 - update to 2.23.0
PowerEdge C6420 - update to 2.23.0
PowerEdge T640 - update to 2.23.0
PowerEdge R940XA - update to 2.23.0
PowerEdge R840 - update to 2.23.0
PowerEdge MX740C - update to 2.23.0
PowerEdge R740XD2 - update to 2.23.0
PowerEdge XR2 - update to 2.23.0
PowerEdge T440 - update to 2.23.0
PowerEdge R440 - update to 2.23.0
PowerEdge R540 - update to 2.23.0
PowerEdge R640 - update to 2.23.0
APEX Cloud Platform for Red Hat OpenShift - update to 03.04.01.00
Dell Integrated System for Microsoft Azure Stack Hub 16G - update to 2502
microcode_ctl - update to 20250211-1

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html

• Multiple vulnerabilities in Intel UEFI Firmware
• Fedora 40 update for microcode_ctl
• Fedora 41 update for microcode_ctl
• openEuler update for microcode_ctl
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Multiple vulnerabilities in Dell Client Platform
• Multiple vulnerabilities in Dell PowerEdge Server
• Multiple vulnerabilities in Dell Integrated System
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components