CVE-2021-38576
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 03 Jan 2022, 21:07
Last modified:03 Nov 2025, 19:26
Vulnerability Summary
Overall Risk (default)
medium
31/100 CVSS Score
7.8 HIGH
v2.0 (nvd)
EPSS Score
0.26% LOW
0% probability +0.07%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
03 Jan 2022, 21:07
Published
Vulnerability first disclosed
03 Nov 2025, 19:26
Last Modified
Vulnerability information updated
Description
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- v2.0•HIGH•Score: 7.8AV:N/AC:L/Au:N/C:N/I:N/A:C
EPSS Trends
Current EPSS score: 0.26%• Percentile: 49%
Affected Systems
- tianocore•edk2
201808 | 201811 | 201903 | 201905 | 201908 | 201911 | 202002 | 202005 | 202008 | 202011 | 202102 | 202105