{
  "document" : {
    "aggregate_severity" : {
      "text" : "niedrig"
    },
    "category" : "csaf_base",
    "csaf_version" : "2.0",
    "distribution" : {
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "de-DE",
    "notes" : [ {
      "category" : "legal_disclaimer",
      "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."
    }, {
      "category" : "description",
      "text" : "Die Firmware ist eine in die Geräte fest eingebettete Software, die dort grundlegende Funktionen leistet.\r\nProLiant ist eine Serverfamilie von Hewlett Packard Enterprise.\r\nSynergy ist eine kombinierbare Blade-Infrastruktur, die Workloads in einer Hybrid Cloud-Umgebung unterstützt.\r\nLenovo ist ein Hersteller u. a. von Computern.",
      "title" : "Produktbeschreibung"
    }, {
      "category" : "summary",
      "text" : "Ein lokaler Angreifer kann eine Schwachstelle in Intel TDX Module Firmware ausnutzen, um Informationen offenzulegen.",
      "title" : "Angriff"
    }, {
      "category" : "general",
      "text" : "- BIOS/Firmware",
      "title" : "Betroffene Betriebssysteme"
    } ],
    "publisher" : {
      "category" : "other",
      "contact_details" : "csaf-provider@cert-bund.de",
      "name" : "Bundesamt für Sicherheit in der Informationstechnik",
      "namespace" : "https://www.bsi.bund.de"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "WID-SEC-W-2024-3126 - CSAF Version",
      "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3126.json"
    }, {
      "category" : "self",
      "summary" : "WID-SEC-2024-3126 - Portal Version",
      "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3126"
    }, {
      "category" : "external",
      "summary" : "Intel Security Advisory INTEL-SA-01099 vom 2024-10-08",
      "url" : "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01099.html"
    }, {
      "category" : "external",
      "summary" : "HPE Security Bulletin HPESBHF04710 rev.1 vom 2024-10-08",
      "url" : "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04710en_us&docLocale=en_US"
    }, {
      "category" : "external",
      "summary" : "Lenovo Security Advisory LEN-158929 vom 2024-10-08",
      "url" : "https://support.lenovo.com/us/en/product_security/LEN-158929"
    }, {
      "category" : "external",
      "summary" : "Dell Security Advisory DSA-2024-385 vom 2024-11-12",
      "url" : "https://www.dell.com/support/kbdoc/de-de/000247691/dsa-2024-385-dell-poweredge-server-security-update-for-intel-tdx-module-software-vulnerability"
    }, {
      "category" : "external",
      "summary" : "Dell Security Advisory DSA-2024-326 vom 2024-12-10",
      "url" : "https://www.dell.com/support/kbdoc/de-de/000227013/dsa-2024-326"
    } ],
    "source_lang" : "en-US",
    "title" : "Intel TDX Module Firmware: Schwachstelle ermöglicht Offenlegung von Informationen",
    "tracking" : {
      "current_release_date" : "2024-12-10T23:00:00.000+00:00",
      "generator" : {
        "date" : "2024-12-11T09:12:34.778+00:00",
        "engine" : {
          "name" : "BSI-WID",
          "version" : "1.3.10"
        }
      },
      "id" : "WID-SEC-W-2024-3126",
      "initial_release_date" : "2024-10-08T22:00:00.000+00:00",
      "revision_history" : [ {
        "date" : "2024-10-08T22:00:00.000+00:00",
        "number" : "1",
        "summary" : "Initiale Fassung"
      }, {
        "date" : "2024-11-12T23:00:00.000+00:00",
        "number" : "2",
        "summary" : "Neue Updates von Dell aufgenommen"
      }, {
        "date" : "2024-12-10T23:00:00.000+00:00",
        "number" : "3",
        "summary" : "Neue Updates von Dell aufgenommen"
      } ],
      "status" : "final",
      "version" : "3"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "category" : "product_name",
        "name" : "Dell Computer",
        "product" : {
          "name" : "Dell Computer",
          "product_id" : "T036868",
          "product_identification_helper" : {
            "cpe" : "cpe:/o:dell:dell_computer:-"
          }
        }
      }, {
        "category" : "product_name",
        "name" : "Dell PowerEdge",
        "product" : {
          "name" : "Dell PowerEdge",
          "product_id" : "T036715",
          "product_identification_helper" : {
            "cpe" : "cpe:/h:dell:poweredge:-"
          }
        }
      } ],
      "category" : "vendor",
      "name" : "Dell"
    }, {
      "branches" : [ {
        "category" : "product_name",
        "name" : "HPE ProLiant",
        "product" : {
          "name" : "HPE ProLiant",
          "product_id" : "T009310",
          "product_identification_helper" : {
            "cpe" : "cpe:/h:hp:proliant:-"
          }
        }
      }, {
        "category" : "product_name",
        "name" : "HPE Synergy",
        "product" : {
          "name" : "HPE Synergy",
          "product_id" : "T019820",
          "product_identification_helper" : {
            "cpe" : "cpe:/h:hpe:synergy:-"
          }
        }
      } ],
      "category" : "vendor",
      "name" : "HPE"
    }, {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "TDX Module <1.5.06",
          "product" : {
            "name" : "Intel Firmware TDX Module <1.5.06",
            "product_id" : "T038080"
          }
        }, {
          "category" : "product_version",
          "name" : "TDX Module 1.5.06",
          "product" : {
            "name" : "Intel Firmware TDX Module 1.5.06",
            "product_id" : "T038080-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:intel:firmware:tdx_module__1.5.06"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "Firmware"
      } ],
      "category" : "vendor",
      "name" : "Intel"
    }, {
      "branches" : [ {
        "category" : "product_name",
        "name" : "Lenovo Computer",
        "product" : {
          "name" : "Lenovo Computer",
          "product_id" : "T030470",
          "product_identification_helper" : {
            "cpe" : "cpe:/h:lenovo:computer:-"
          }
        }
      } ],
      "category" : "vendor",
      "name" : "Lenovo"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2024-27457",
    "notes" : [ {
      "category" : "description",
      "text" : "Es existiert eine Schwachstelle in der Intel TDX Module Firmware. Die Ursache ist eine unzureichende Prüfung auf ungewöhnliche oder außergewöhnliche Bedingungen. Ein lokaler privilegierter Angreifer kann die Schwachstelle ausnutzen, um Informationen offenzulegen."
    } ],
    "product_status" : {
      "known_affected" : [ "T036715", "T019820", "T036868", "T038080", "T030470", "T009310" ]
    },
    "release_date" : "2024-10-08T22:00:00.000+00:00",
    "title" : "CVE-2024-27457"
  } ]
}