CVE-2024-28047

Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

The impact of this issue is Moderate for Red Hat Enterprise Linux. Improper input validation in UEFI firmware for some Intel processors may allow a privileged local user to enable information disclosure. The issue is scored 5.3 (CVSS v3.1: AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N), reflecting the need for local access, high attack complexity, and high privileges, with confidentiality impact but no integrity or availability impact. The affected scope includes the listed RHEL 7 ELS, RHEL 8, RHEL 9.6, and RHEL 10 microcode_ctl streams; the current affects data does not identify any not-affected RHEL product. RHEL 7 and RHEL 8 entries are marked out of support, RHEL 9.6 is delegated as affected with a fix being pursued, and the RHEL 10 entry is delegated with a WONTFIX resolution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.