Potential Buffer Overflow in UEFI Variable Handling
CVE-2024-1598

7.5HIGH

Key Information:

Vendor

Phoenix

Status
Securecoreā„¢ For Intel Gemini Lake
Vendor
CVE Published:
14 May 2024

What is CVE-2024-1598?

A vulnerability exists in the Phoenix SecureCoreā„¢ product designed for Intel Gemini Lake platforms, where unsafe handling of UEFI variables can lead to potential buffer overflow scenarios. This flaw targets versions from 4.1.0.1 up to but not including 4.1.0.567. Exploitation may allow unauthorized access or manipulation of system configurations, presenting a significant risk to system integrity. Users and administrators are advised to review their affected products and consider implementing the necessary updates as recommended by Phoenix Technologies.

Affected Version(s)

SecureCoreā„¢ for Intel Gemini Lake 4.1.0.1 < 4.1.0.567

References

https://www.phoenix.com/security-notifications/cve-2024-1...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zichuan Li from Indiana University Bloomington
.