CVE-2024-31157

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Moderate impact: Red Hat Enterprise Linux systems using the affected microcode_ctl component may allow a privileged local user to exploit improper initialization in the UEFI firmware OutOfBandXML module on some Intel processors, potentially causing information disclosure. The local attack requires high privileges and high attack complexity, consistent with the current CVSS 3.1 score of 5.3 (Moderate), with high confidentiality impact and no integrity or availability impact. The issue affects the recorded Red Hat Enterprise Linux 7 ELS and Red Hat Enterprise Linux 8 streams, and Red Hat Enterprise Linux 9.6, for which a fix is being pursued. Red Hat Enterprise Linux 10.0 is not affected because the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.