PT-2022-1510 · Microsoft · Windows Extensible Firmware Interface+1

Abdelhamid Naceri · Published 2022-01-11 · Updated 2024-11-14 · CVE-2022-21899

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Windows Extensible Firmware Interface (affected versions not specified)

Description The issue is related to errors in authorization when accessing files in the EFI section, which can lead to a denial-of-service condition. This can be exploited by an attacker to affect the system. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2022-00699

CVE-2022-21899

ZDI-22-052

Affected Products

Windows

Windows Extensible Firmware Interface

References · 11

• https://bdu.fstec.ru/vul/2022-00699 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-052 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21899 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21899 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-21899 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21899 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21899 · Security Note
• https://t.me/cvenotify/25662 · Telegram Post
• https://t.me/cibsecurity/35296 · Telegram Post
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21899 · Note