CVE-2021-38576

HIGH
Published Jan 3, 20224y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Jan 3, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
No Patch Available

Affected Products 12

VendorProductVersionRange
tianocoreedk2201808any
tianocoreedk2201811any
tianocoreedk2201903any
tianocoreedk2201905any
tianocoreedk2201908any
tianocoreedk2201911any
tianocoreedk2202002any
tianocoreedk2202005any
tianocoreedk2202008any
tianocoreedk2202011any
tianocoreedk2202102any
tianocoreedk2202105any

References 2

  • bugzilla.tianocore.org https://bugzilla.tianocore.org/show_bug.cgi?id=3499
    Issue TrackingPermissions RequiredThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.