SB2024121921 - HPE SimpliVity servers update for Intel UEFI firmware

Security Bulletin ID SB2024121921

Severity

Low

Patch available

YES

Number of vulnerabilities 4

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2024-21829)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in UEFI firmware error handler. A local privileged user can execute arbitrary code with elevated privileges.

2) Input validation error (CVE-ID: CVE-2024-21781)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in UEFI firmware. A local privileged user can gain access to sensitive information or perform a denial of service (DoS) attack.

3) Improper handling of exceptional conditions (CVE-ID: CVE-2023-43753)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper handling of errors in Intel Processors with Intel Software Guard Extensions. A local user can gain access to sensitive information.

4) Race condition (CVE-ID: CVE-2024-23599)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition in Seamless Firmware Updates for some Intel reference platforms. A local user can exploit the race and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04753en_us