Описание
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
A flaw was found in the Unified Extensible Firmware Interface (UEFI) firmware for Intel processors. Due to improper input validation, a local attacker with elevated administrative privileges can bypass security boundaries to read protected system memory. This vulnerability primarily results in information disclosure.
Отчет
The impact of this issue is Moderate for Red Hat Enterprise Linux. Improper input validation in UEFI firmware for some Intel processors may allow a privileged local user to enable information disclosure. The issue is scored 5.3 (CVSS v3.1: AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N), reflecting the need for local access, high attack complexity, and high privileges, with confidentiality impact but no integrity or availability impact. The affected scope includes the listed RHEL 7 ELS, RHEL 8, RHEL 9.6, and RHEL 10 microcode_ctl streams; the current affects data does not identify any not-affected RHEL product. RHEL 7 and RHEL 8 entries are marked out of support, RHEL 9.6 is delegated as affected with a fix being pursued, and the RHEL 10 entry is delegated with a WONTFIX resolution.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | microcode_ctl | Will not fix | ||
| Red Hat Enterprise Linux 7 | microcode_ctl | Out of support scope | ||
| Red Hat Enterprise Linux 8 | microcode_ctl | Fixed | RHEA-2025:3114 | 24.03.2025 |
| Red Hat Enterprise Linux 9 | microcode_ctl | Fixed | RHSA-2025:7043 | 13.05.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Improper input validation in UEFI firmware for some Intel(R) Processor ...
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Уязвимость микропрограммного обеспечения UEFI процессоров Intel, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
5.3 Medium
CVSS3