CVE-2024-0762— Potential buffer overflow when handling UEFI variables
Quick assessment
Affected
Phoenix SecureCore™ for Intel Kaby Lake
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Phoenix SecureCore是德国菲尼克斯电气（Phoenix）公司的一个计算机基础输入/输出系统。 Phoenix SecureCore存在安全漏洞，该漏洞源于缓冲区溢出。
Possible ATT&CK Techniques 3 AI
T1195.002 · Compromise Software Supply Chain T1211 · Exploitation for Stealth T1542.001 · System Firmware
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-0762
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Potential buffer overflow when handling UEFI variables
Source: CVE Program / CVE List V5
Vulnerability Description
Potential buffer overflow
in unsafe UEFI variable handling
in Phoenix SecureCore™ for select Intel platforms
This issue affects:
Phoenix
SecureCore™ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998;
Phoenix
SecureCore™ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562;
Phoenix
SecureCore™ for Intel Ice Lake: from 4.2.0.1 before 4.2.0.323;
Phoenix
SecureCore™ for Intel Comet Lake: from 4.2.1.1 before 4.2.1.287;
Phoenix
SecureCore™ for Intel Tiger Lake: from 4.3.0.1 before 4.3.0.236;
Phoenix
SecureCore™ for Intel Jasper Lake: from 4.3.1.1 before 4.3.1.184;
Phoenix
SecureCore™ for Intel Alder Lake: from 4.4.0.1 before 4.4.0.269;
Phoenix
SecureCore™ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218;
Phoenix
SecureCore™ for Intel Meteor Lake: from 4.5.1.1 before 4.5.1.15.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Phoenix SecureCore 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Phoenix SecureCore是德国菲尼克斯电气（Phoenix）公司的一个计算机基础输入/输出系统。 Phoenix SecureCore存在安全漏洞，该漏洞源于缓冲区溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Phoenix | SecureCore™ for Intel Kaby Lake | 4.0.1.1 ~ 4.0.1.998 | - |
|
| Phoenix | SecureCore™ for Intel Coffee Lake | 4.1.0.1 ~ 4.1.0.562 | - |
|
| Phoenix | SecureCore™ for Intel Ice Lake | 4.2.0.1 ~ 4.2.0.323 | - |
|
| Phoenix | SecureCore™ for Intel Comet Lake | 4.2.1.1 ~ 4.2.1.287 | - |
|
| Phoenix | SecureCore™ for Intel Tiger Lake | 4.3.0.1 ~ 4.3.0.236 | - |
|
| Phoenix | SecureCore™ for Intel Jasper Lake | 4.3.1.1 ~ 4.3.1.184 | - |
|
| Phoenix | SecureCore™ for Intel Alder Lake | 4.4.0.1 ~ 4.4.0.269 | - |
|
| Phoenix | SecureCore™ for Intel Raptor Lake | 4.5.0.1 ~ 4.5.0.218 | - |
|
| Phoenix | SecureCore™ for Intel Meteor Lake | 4.5.1.1 ~ 4.5.1.15 | - |
|
II. Public POCs for CVE-2024-0762
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Detecting vulnerabilities like CVE-2024-0762, particularly in UEFI firmware, is quite challenging due to the low-level nature | https://github.com/tadash10/Detect-CVE-2024-0762 | POC Details |
| 2 | UEFIcanhazbufferoverflow | https://github.com/abandon1337/CVE-2024-0762 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-0762
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-0762 (1)
Security Blog Posts for CVE-2024-0762 (1)
Other References for CVE-2024-0762 (1)
Same Patch Batch · Phoenix · 2024-05-14 · 3 CVEs total
| CVE-2023-35841 | 7.8 HIGH | WinFlash Driver Permissions Issue |
| CVE-2024-1598 | 7.5 HIGH | Potential buffer overflow when handling UEFI variables |
IV. Related Vulnerabilities
V. Comments for CVE-2024-0762
No comments yet