PT-2021-8089 · Intel+2 · Tianocore Edk2+2

Published 2021-07-19 · Updated 2025-06-05 · CVE-2021-38576

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Tianocore edk2 (affected versions not specified)

Description The issue concerns a BIOS bug and a library vulnerability. The BIOS bug affects the Platform authorization value, leaving it empty, which can lead to the permanent bricking of the TPM and temporary denial of service (DoS) to the system. Additionally, there is a vulnerability related to resource release errors in the Tianocore edk2 library, which can be exploited by a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2024-06957

CVE-2021-38576

DLA-4207-1

OESA-2022-1515

Affected Products

Astra Linux

Debian

Tianocore Edk2

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2021-38576 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1515 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38576 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4207-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38576 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-38576 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-38576 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06957 · Security Note
• https://ubuntu.com/security/CVE-2021-38576 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38576 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://github.com/tianocore/edk2/pull/1968 · Note
• https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html · Note
• https://bugzilla.tianocore.org/show_bug.cgi?id=3499 · Note