« Volver al listado

CVE-2021-38576

Estado: ModificadaAlta (7.5)—

A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tianocore — Edk2

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-38576",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "infosec@edk2.groups.io",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "EDK II",
          "versions": [
            {
              "status": "affected",
              "version": "edk2-stable202105, edk2-stable202102, edk2-stable202011, edk2-stable202008, edk2-stable202005, edk2-stable202002, edk2-stable201911, edk2-stable201908, edk2-stable201905, edk2-stable201903, edk2-stable201811, edk2-stable201808"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-03T22:15:09.903",
  "references": [
    {
      "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=3499",
      "tags": [
        "Issue Tracking",
        "Permissions Required",
        "Third Party Advisory"
      ],
      "source": "infosec@edk2.groups.io"
    },
    {
      "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=3499",
      "tags": [
        "Issue Tracking",
        "Permissions Required",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system."
    },
    {
      "lang": "es",
      "value": "Un error de la BIOS en el firmware de un determinado modelo de PC deja vacío el valor de autorización de la plataforma. Esto puede ser usado para brickear permanentemente el TPM de múltiples maneras, así como para DoS no permanente del sistema"
    }
  ],
  "lastModified": "2026-06-17T04:02:23.653",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:201808:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8757385B-6944-488F-B565-417A37C24774"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:201811:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5C29B4B-635D-498E-BFA0-C99810C7867F"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:201903:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A599E9E7-B318-4C66-A2F8-6137DE9EF8AC"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:201905:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A3F577A-A397-4185-B477-C31065B6F598"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:201908:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76E6EC0C-BA9E-47AD-9A8E-D40BE97CAAFA"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:201911:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2AFB7F1-63CF-4E11-8FD5-1E8D054616CF"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:202002:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02217318-D1DB-41BB-BE48-89BC3F0FA38C"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:202005:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5193EFCE-3330-48FA-8C63-4CE328A2D339"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:202008:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C45BEB6-1F89-4813-B2CF-90639F9CE525"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:202011:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C76CE4FB-3BDE-464B-9807-093839D6DB24"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:202102:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "063761E2-5C4D-480F-90FE-41D5ECC35E94"
            },
            {
              "criteria": "cpe:2.3:a:tianocore:edk2:202105:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07F01519-D5C8-4BEE-A89B-8090F9A415CF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "infosec@edk2.groups.io"
}