Search criteria

3 vulnerabilities found for elan_match-on-chip_fpr_solution_firmware by emc

FKIE_CVE-2024-0454

Vulnerability from fkie_nvd - Published: 2024-01-12 02:15 - Updated: 2024-11-21 08:46
Severity ?
6.0 (Medium) - CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
6.1 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.
References
36106deb-8e95-420b-a0a0-e70af5d245dfhttps://www.emc.com.tw/emc/tw/vulnerability-disclosure-policyNot Applicable
nvd@nist.govhttps://github.com/advisories/GHSA-w3jx-33qh-77f8Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policyNot Applicable
Impacted products
Vendor Product Version
emc elan_match-on-chip_fpr_solution_firmware 3.0.12011.08009
emc elan_match-on-chip_fpr_solution_firmware 3.3.12011.08103
emc elan_match-on-chip_fpr_solution -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.0.12011.08009:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D3B550F-D100-4116-AE9F-7F9F203F7B0F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.3.12011.08103:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BD8D8C7-1B4D-4452-8BC2-6D2B05939AC1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:emc:elan_match-on-chip_fpr_solution:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "02144756-1716-40FF-884B-3E4DD9D2C0A3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."
    },
    {
      "lang": "es",
      "value": "La soluci\u00f3n ELAN Match-on-Chip FPR tiene un error de dise\u00f1o sobre el riesgo potencial de fuga de SID v\u00e1lido y enumeraci\u00f3n con sensor falso. Este fallo hace que el reconocimiento de Windows Hello se omita al clonar el SID para causar una p\u00e9rdida de identidad de la cuenta. La versi\u00f3n inferior a 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) sufrir\u00eda este riesgo en la plataforma DELL Inspiron."
    }
  ],
  "id": "CVE-2024-0454",
  "lastModified": "2024-11-21T08:46:37.533",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 5.5,
        "source": "36106deb-8e95-420b-a0a0-e70af5d245df",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-01-12T02:15:44.867",
  "references": [
    {
      "source": "36106deb-8e95-420b-a0a0-e70af5d245df",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"
    },
    {
      "source": "nvd@nist.gov",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-w3jx-33qh-77f8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"
    }
  ],
  "sourceIdentifier": "36106deb-8e95-420b-a0a0-e70af5d245df",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ],
      "source": "36106deb-8e95-420b-a0a0-e70af5d245df",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2024-0454 (GCVE-0-2024-0454)

Vulnerability from cvelistv5 – Published: 2024-01-12 01:48 – Updated: 2024-11-06 17:10
VLAI?
Summary
ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.
Severity ?
6 (Medium)
CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
CWE
  • CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
Vendor Product Version
ELAN DELL Inspiron Affected: 3.0.12011.08001 , < 3.0.12011.08009 (custom)
Affected: 3.3.12011.08101 , < 3.3.12011.08103 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:04:49.725Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:elan:dell_inspiron:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dell_inspiron",
            "vendor": "elan",
            "versions": [
              {
                "lessThan": "3.0.12011.08009",
                "status": "affected",
                "version": "3.0.12011.08001",
                "versionType": "custom"
              },
              {
                "lessThan": "3.3.12011.08103",
                "status": "affected",
                "version": "3.3.12011.08101",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0454",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:07:08.650230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:10:10.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "Windows Hello Identification"
          ],
          "packageName": "UMDF Driver",
          "platforms": [
            "Windows"
          ],
          "product": "DELL Inspiron",
          "vendor": "ELAN",
          "versions": [
            {
              "lessThan": "3.0.12011.08009",
              "status": "affected",
              "version": "3.0.12011.08001",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.12011.08103",
              "status": "affected",
              "version": "3.3.12011.08101",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-01-12T01:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\u003cbr\u003eThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\u003cbr\u003eVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."
            }
          ],
          "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T01:48:47.887Z",
        "orgId": "36106deb-8e95-420b-a0a0-e70af5d245df",
        "shortName": "ELAN"
      },
      "references": [
        {
          "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Security Vulnerability on Match-on-Chip FPR Architecture",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36106deb-8e95-420b-a0a0-e70af5d245df",
    "assignerShortName": "ELAN",
    "cveId": "CVE-2024-0454",
    "datePublished": "2024-01-12T01:48:47.887Z",
    "dateReserved": "2024-01-12T01:47:40.093Z",
    "dateUpdated": "2024-11-06T17:10:10.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-0454 (GCVE-0-2024-0454)

Vulnerability from nvd – Published: 2024-01-12 01:48 – Updated: 2024-11-06 17:10
VLAI?
Summary
ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.
Severity ?
6 (Medium)
CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
CWE
  • CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
Vendor Product Version
ELAN DELL Inspiron Affected: 3.0.12011.08001 , < 3.0.12011.08009 (custom)
Affected: 3.3.12011.08101 , < 3.3.12011.08103 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:04:49.725Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:elan:dell_inspiron:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dell_inspiron",
            "vendor": "elan",
            "versions": [
              {
                "lessThan": "3.0.12011.08009",
                "status": "affected",
                "version": "3.0.12011.08001",
                "versionType": "custom"
              },
              {
                "lessThan": "3.3.12011.08103",
                "status": "affected",
                "version": "3.3.12011.08101",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0454",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:07:08.650230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:10:10.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "Windows Hello Identification"
          ],
          "packageName": "UMDF Driver",
          "platforms": [
            "Windows"
          ],
          "product": "DELL Inspiron",
          "vendor": "ELAN",
          "versions": [
            {
              "lessThan": "3.0.12011.08009",
              "status": "affected",
              "version": "3.0.12011.08001",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.12011.08103",
              "status": "affected",
              "version": "3.3.12011.08101",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-01-12T01:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\u003cbr\u003eThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\u003cbr\u003eVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."
            }
          ],
          "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T01:48:47.887Z",
        "orgId": "36106deb-8e95-420b-a0a0-e70af5d245df",
        "shortName": "ELAN"
      },
      "references": [
        {
          "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Security Vulnerability on Match-on-Chip FPR Architecture",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36106deb-8e95-420b-a0a0-e70af5d245df",
    "assignerShortName": "ELAN",
    "cveId": "CVE-2024-0454",
    "datePublished": "2024-01-12T01:48:47.887Z",
    "dateReserved": "2024-01-12T01:47:40.093Z",
    "dateUpdated": "2024-11-06T17:10:10.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}