CVE-2023-43758
Published: 12 February 2025
Description
Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.
Security Summary
CVE-2023-43758 is an improper input validation vulnerability, classified under CWE-20, affecting UEFI firmware on some Intel processors. Published on 2025-02-12, it carries a CVSS v3.1 base score of 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
The vulnerability can be exploited by a privileged user with local access, who may leverage improper input validation to escalate privileges. Successful exploitation requires high privileges and low complexity but no user interaction, with a changed scope that amplifies effects on the system.
Intel's security advisory (INTEL-SA-01139) addresses the issue, and a Debian LTS announcement details mitigations for affected packages.
Details
- CWE(s)