BIOS Bug in Firmware Leaves TPM Vulnerable on Specific PC Models
CVE-2021-38576

7.5HIGH

Key Information:

Vendor

Tianocore

Status
Edk Ii
Vendor
CVE Published:
3 January 2022

What is CVE-2021-38576?

A BIOS flaw in firmware for certain PC models results in an empty Platform authorization value. This can lead to critical issues, including the potential for permanently disabling the Trusted Platform Module (TPM) or causing temporary denial of service (DoS) on affected systems. This vulnerability highlights the need for diligent firmware management to ensure secure operation.

Affected Version(s)

EDK II edk2-stable202105, edk2-stable202102, edk2-stable202011, edk2-stable202008, edk2-stable202005, edk2-stable202002, edk2-stable201911, edk2-stable201908, edk2-stable201905, edk2-stable201903, edk2-stable201811, edk2-stable201808

References

https://bugzilla.tianocore.org/show_bug.cgi?id=3499
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.