Vulnerability · Published Jan 14, 2025 · Assigned by Phoenix
CVE-2024-29980Unsafe Handling of IHV UEFI Variables
Low 2.3
In plain English
A low-severity security flaw in SecureCore™ for Intel Coffee Lake from Phoenix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCore™ for Intel Kaby Lake: before 4.0.1.1012; SecureCore™ for Intel Coffee Lake: before 4.1.0.568; SecureCore™ for Intel Comet Lake: before 4.2.1.292; SecureCore™ for Intel Ice Lake: before 4.2.0.334.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Phoenix | SecureCore™ for Intel Kaby Lake | 0 – before 4.0.1.1012 |
| Phoenix | SecureCore™ for Intel Coffee Lake | 0 – before 4.1.0.568 |
| Phoenix | SecureCore™ for Intel Comet Lake | 0 – before 4.2.1.292 |
| Phoenix | SecureCore™ for Intel Ice Lake | 0 – before 4.2.0.334 |
Weakness: CWE-754 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L