Input validation error in Intel products - CVE-2024-21781

Vulnerability identifier: #VU97438

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-21781

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in UEFI firmware. A local privileged user can gain access to sensitive information or perform a denial of service (DoS) attack.

Intel Xeon D Processors
3rd Generation Intel Xeon Scalable Processors
Intel Atom Processor C5000
Intel Atom Processor P5000 Series
2nd Generation Intel Xeon Scalable Processors
Superdome Flex 280 Server
Precision 7920 Rack
Precision 7920 XL Rack
Superdome Flex Server
HPE SimpliVity 380 Gen10
HPE SimpliVity 380 Gen10 G
HPE SimpliVity 380 Gen10 H
HPE SimpliVity 190r Gen10 Server
HPE SimpliVity 170r Gen10 Server
HPE SimpliVity 380 Gen10 Plus
HPE SimpliVity 380 Gen11
Intel Xeon Scalable Processors
APEX Cloud Platform for Microsoft Azure
F5OS
APEX Cloud Platform for Red Hat OpenShift

Install updates from vendor's website.

APEX Cloud Platform for Microsoft Azure - update to 01.04.00.00
Superdome Flex 280 Server - update to 1.90.12
Precision 7920 Rack - update to 2.22.2
Precision 7920 XL Rack - update to 2.22.2
APEX Cloud Platform for Red Hat OpenShift - update to 03.03.00.00
Superdome Flex Server - update to 4.0.10
HPE SimpliVity 380 Gen10 - update to 2024_1129
HPE SimpliVity 380 Gen10 G - update to 2024_1129
HPE SimpliVity 380 Gen10 H - update to 2024_1129
HPE SimpliVity 190r Gen10 Server - update to 2024_1129
HPE SimpliVity 170r Gen10 Server - update to 2024_1129
HPE SimpliVity 380 Gen10 Plus - update to 2024_1129
HPE SimpliVity 380 Gen11 - update to 2024_1129

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html

• Multiple vulnerabilities in Intel UEFI firmware
• HPE Superdome Flex and Superdome Flex 280 servers update for Intel UEFI firmware
• Local denial of service in F5OS Intel UEFI firmware
• Dell Precision Rack update for Intel CPU firmware
• HPE SimpliVity servers update for Intel UEFI firmware
• Multiple vulnerabilities in Dell APEX Cloud Platform for Red Hat OpenShift
• APEX Cloud Platform for Microsoft Azure update for third-party components