PT-2024-19074 · Intel+5 · Intel Xeon+5

Published 2024-11-13 · Updated 2025-03-28 · CVE-2024-21820

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Intel Xeon processor memory controller (affected versions not specified)

Description The issue concerns incorrect default permissions in certain Intel Xeon processor memory controller configurations when using Intel SGX. This may allow a privileged user to potentially enable escalation of privilege via local access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2025-01980

CVE-2024-21820

DLA-4002-1

MGASA-2024-0377

OESA-2024-2524

OPENSUSE-SU-2024:14496-1

OPENSUSE-SU-2024_4053-1

SUSE-SU-2024:3995-1

SUSE-SU-2024:4053-1

SUSE-SU-2024_3995-1

SUSE-SU-2024_4053-1

SUSE-SU-2025:1032-1

SUSE-SU-2025:20092-1

SUSE-SU-2025:20286-1

USN-7149-1

Affected Products

Astra Linux

Intel Xeon

Linuxmint

Red Os

Suse

Ubuntu

References · 84

• https://ubuntu.com/security/CVE-2024-23918 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-21820 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1032-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-21820 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4053-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24968 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-21820 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21853 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-21820 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14496-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20286-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-21820 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21820 · Security Note