CVE-2024-38798
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: TianoCore.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| edk2 | edk2 | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in EDK2 BIOS allows an attacker with local access to cause exposure of sensitive information to unauthorized actors. Successful exploitation can lead to information disclosure or escalation of privilege, impacting the confidentiality of the system.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information or allow an attacker to escalate their privileges on the affected system, potentially compromising system confidentiality and security.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability leads to exposure of sensitive password information to unauthorized actors, which can result in information disclosure and escalation of privilege. Such exposure of sensitive data could negatively impact compliance with standards and regulations like GDPR and HIPAA that require protection of personal and sensitive information. Organizations affected by this vulnerability may face challenges in maintaining confidentiality and data protection obligations under these regulations. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves residual password keystrokes stored in a circular queue in memory within the EDK2 firmware USB keyboard driver. Detection requires local access to the system to examine the memory region where the circular queue is stored. Since the vulnerability is in firmware memory, typical network detection commands are not applicable. A possible approach is to use low-level memory inspection tools or firmware debugging utilities to inspect the USB keyboard driver's memory buffers for residual password data. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the EDK2 firmware package to version 202511 or later, where the patch addressing this vulnerability has been applied. Until the update can be applied, restrict local access to systems using affected EDK2 versions to prevent unauthorized actors from exploiting the vulnerability. Additionally, monitor and control physical access to devices to reduce risk. [1]