CVE-2024-29214
Published: 12 February 2025
Description
Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Security Summary
CVE-2024-29214 is an improper input validation vulnerability (CWE-20) in the UEFI firmware component CseVariableStorageSmm, affecting some Intel processors. Published on 2025-02-12, it carries a CVSS v3.1 base score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity with potential for significant impact.
The vulnerability can be exploited by a privileged user with local access, requiring high attack complexity but no user interaction. Successful exploitation may enable escalation of privilege, allowing the attacker to achieve high levels of confidentiality, integrity, and availability impacts across a changed scope.
Intel's security advisory INTEL-SA-01139 details the issue, while Debian LTS has issued an announcement in their mailing list regarding related updates. Practitioners should consult these references for mitigation guidance and patch availability.
Details
- CWE(s)