CVE-2024-21823: linux
Vulnerability summary
CVE-2024-21823 is a high (CVSS 7.5) vulnerability in linux. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.3% of scored vulnerabilities.
Not severe (CVSS 7.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 35 · Related 25Timeline
- 16-05-2024PublishedVulnerability first disclosed.
- 14-08-2024Last modifiedVulnerability information updated.
Description
Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
- NVDNIST7.5HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.20% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1264Hardware Logic with Insecure De-Synchronization between Control and Data ChannelsThe hardware logic for error handling and security checks can incorrectly forward data before the security check is complete.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu120 products
- linuxAll versions (No fix recorded) | < 5.15.0-112.122 | < 6.8.0-35.35
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1064.70 | < 6.8.0-1010.10
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian1 product
- linux< 6.1.94-1 | < 6.8.11-1
2 vendors · 121 products
