CVE-2024-38798

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-38798", "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c", "state": "PUBLISHED", "assignerShortName": "TianoCore", "dateReserved": "2024-06-19T17:05:09.905Z", "datePublished": "2025-12-09T15:00:10.016Z", "dateUpdated": "2025-12-09T15:14:14.916Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "MdeModulePkg", "product": "EDK2", "vendor": "TianoCore", "versions": [{"lessThan": "edk2-stable202511", "status": "affected", "version": "0", "versionType": "Custom"}]}], "datePublic": "2025-12-09T15:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "EDK2 contains a vulnerability in BIOS where an attacker may cause \u201cExposure of Sensitive Information to an Unauthorized Actor\u201d by local access. Successful exploitation of this vulnerability will lead to \n\n<span style=\"background-color: rgb(255, 255, 255);\">possible information disclosure or escalation of privilege</span>\n\n and impact Confidentiality."}], "value": "EDK2 contains a vulnerability in BIOS where an attacker may cause \u201cExposure of Sensitive Information to an Unauthorized Actor\u201d by local access. Successful exploitation of this vulnerability will lead to \n\npossible information disclosure or escalation of privilege\n\n and impact Confidentiality."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 5.8, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "65518388-201a-4f93-8712-366d21fe8d2c", "shortName": "TianoCore", "dateUpdated": "2025-12-09T15:00:10.016Z"}, "references": [{"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-q2c6-37h5-7cwf"}], "source": {"discovery": "UNKNOWN"}, "title": "Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T15:14:01.432266Z", "id": "CVE-2024-38798", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T15:14:14.916Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38798", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T15:14:01.432266Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T15:14:11.425Z"}}], "cna": {"title": "Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TianoCore", "product": "EDK2", "versions": [{"status": "affected", "version": "0", "lessThan": "edk2-stable202511", "versionType": "Custom"}], "packageName": "MdeModulePkg", "defaultStatus": "unaffected"}], "datePublic": "2025-12-09T15:00:00.000Z", "references": [{"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-q2c6-37h5-7cwf"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "EDK2 contains a vulnerability in BIOS where an attacker may cause \u201cExposure of Sensitive Information to an Unauthorized Actor\u201d by local access. Successful exploitation of this vulnerability will lead to \n\npossible information disclosure or escalation of privilege\n\n and impact Confidentiality.", "supportingMedia": [{"type": "text/html", "value": "EDK2 contains a vulnerability in BIOS where an attacker may cause \u201cExposure of Sensitive Information to an Unauthorized Actor\u201d by local access. Successful exploitation of this vulnerability will lead to \n\n<span style=\"background-color: rgb(255, 255, 255);\">possible information disclosure or escalation of privilege</span>\n\n and impact Confidentiality.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "65518388-201a-4f93-8712-366d21fe8d2c", "shortName": "TianoCore", "dateUpdated": "2025-12-09T15:00:10.016Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38798", "state": "PUBLISHED", "dateUpdated": "2025-12-09T15:14:14.916Z", "dateReserved": "2024-06-19T17:05:09.905Z", "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c", "datePublished": "2025-12-09T15:00:10.016Z", "assignerShortName": "TianoCore"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "MdeModulePkg", "product": "EDK2", "vendor": "TianoCore", "versions": [{"lessThan": "edk2-stable202511", "status": "affected", "version": "0", "versionType": "Custom"}]}], "source": "infosec@edk2.groups.io"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EDK2 contains a vulnerability in BIOS where an attacker may cause \u201cExposure of Sensitive Information to an Unauthorized Actor\u201d by local access. Successful exploitation of this vulnerability will lead to \n\npossible information disclosure or escalation of privilege\n\n and impact Confidentiality."}, {"lang": "es", "value": "EDK2 contiene una vulnerabilidad en el BIOS donde un atacante puede causar 'Exposici\u00f3n de Informaci\u00f3n Sensible a un Actor No Autorizado' mediante acceso local. La explotaci\u00f3n exitosa de esta vulnerabilidad conducir\u00e1 a posible revelaci\u00f3n de informaci\u00f3n o escalada de privilegios y tendr\u00e1 impacto en la Confidencialidad."}], "id": "CVE-2024-38798", "lastModified": "2026-10-02T00:10:00.180", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "infosec@edk2.groups.io", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-38798", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-09T15:14:01.432266Z", "version": "2.0.3"}}]}, "published": "2025-12-09T16:17:27.787", "references": [{"source": "infosec@edk2.groups.io", "url": "https://github.com/tianocore/edk2/security/advisories/GHSA-q2c6-37h5-7cwf"}], "sourceIdentifier": "infosec@edk2.groups.io", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "infosec@edk2.groups.io", "type": "Secondary"}]}

{"bugzilla": {"description": "EDK2: EDK2: Information Disclosure and Privilege Escalation via Local BIOS Access", "id": "2420643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2420643"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-200", "details": ["EDK2 contains a vulnerability in BIOS where an attacker may cause \u201cExposure of Sensitive Information to an Unauthorized Actor\u201d by local access. Successful exploitation of this vulnerability will lead to \npossible information disclosure or escalation of privilege\nand impact Confidentiality.", "A flaw was found in EDK2. This vulnerability allows information disclosure or escalation of privilege via local access to the BIOS (Basic Input/Output System)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2024-38798", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-12-09T15:00:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-38798\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-38798\nhttps://github.com/tianocore/edk2/security/advisories/GHSA-q2c6-37h5-7cwf"], "statement": "This vulnerability is rated Moderate for Red Hat as it requires local access to the system. The flaw in EDK2, a BIOS component, could lead to information disclosure or escalation of privilege by an attacker with local access. This primarily affects the underlying hardware firmware.", "threat_severity": "Moderate"}

{"created": "2025-12-10T17:49:33.383349+00:00", "updated": "2025-12-10T17:49:33.383389+00:00", "vendors": ["tianocore", "tianocore$PRODUCT$edk2"]}