CVE-2024-0454 (GCVE-0-2024-0454)

Vulnerability from cvelistv5 – Published: 2024-01-12 01:48 – Updated: 2024-11-06 17:10
VLAI?
Summary
ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.
Severity ?
6 (Medium)
CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
CWE
  • CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
Vendor Product Version
ELAN DELL Inspiron Affected: 3.0.12011.08001 , < 3.0.12011.08009 (custom)
Affected: 3.3.12011.08101 , < 3.3.12011.08103 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:04:49.725Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:elan:dell_inspiron:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dell_inspiron",
            "vendor": "elan",
            "versions": [
              {
                "lessThan": "3.0.12011.08009",
                "status": "affected",
                "version": "3.0.12011.08001",
                "versionType": "custom"
              },
              {
                "lessThan": "3.3.12011.08103",
                "status": "affected",
                "version": "3.3.12011.08101",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0454",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:07:08.650230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:10:10.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "Windows Hello Identification"
          ],
          "packageName": "UMDF Driver",
          "platforms": [
            "Windows"
          ],
          "product": "DELL Inspiron",
          "vendor": "ELAN",
          "versions": [
            {
              "lessThan": "3.0.12011.08009",
              "status": "affected",
              "version": "3.0.12011.08001",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.12011.08103",
              "status": "affected",
              "version": "3.3.12011.08101",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-01-12T01:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\u003cbr\u003eThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\u003cbr\u003eVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."
            }
          ],
          "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T01:48:47.887Z",
        "orgId": "36106deb-8e95-420b-a0a0-e70af5d245df",
        "shortName": "ELAN"
      },
      "references": [
        {
          "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Security Vulnerability on Match-on-Chip FPR Architecture",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36106deb-8e95-420b-a0a0-e70af5d245df",
    "assignerShortName": "ELAN",
    "cveId": "CVE-2024-0454",
    "datePublished": "2024-01-12T01:48:47.887Z",
    "dateReserved": "2024-01-12T01:47:40.093Z",
    "dateUpdated": "2024-11-06T17:10:10.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.0.12011.08009:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6D3B550F-D100-4116-AE9F-7F9F203F7B0F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.3.12011.08103:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8BD8D8C7-1B4D-4452-8BC2-6D2B05939AC1\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:emc:elan_match-on-chip_fpr_solution:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"02144756-1716-40FF-884B-3E4DD9D2C0A3\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.\"}, {\"lang\": \"es\", \"value\": \"La soluci\\u00f3n ELAN Match-on-Chip FPR tiene un error de dise\\u00f1o sobre el riesgo potencial de fuga de SID v\\u00e1lido y enumeraci\\u00f3n con sensor falso. Este fallo hace que el reconocimiento de Windows Hello se omita al clonar el SID para causar una p\\u00e9rdida de identidad de la cuenta. La versi\\u00f3n inferior a 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) sufrir\\u00eda este riesgo en la plataforma DELL Inspiron.\"}]",
      "id": "CVE-2024-0454",
      "lastModified": "2024-11-21T08:46:37.533",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"36106deb-8e95-420b-a0a0-e70af5d245df\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L\", \"baseScore\": 6.0, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"PHYSICAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 0.5, \"impactScore\": 5.5}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"PHYSICAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 0.9, \"impactScore\": 5.2}]}",
      "published": "2024-01-12T02:15:44.867",
      "references": "[{\"url\": \"https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy\", \"source\": \"36106deb-8e95-420b-a0a0-e70af5d245df\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://github.com/advisories/GHSA-w3jx-33qh-77f8\", \"source\": \"nvd@nist.gov\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Not Applicable\"]}]",
      "sourceIdentifier": "36106deb-8e95-420b-a0a0-e70af5d245df",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"36106deb-8e95-420b-a0a0-e70af5d245df\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-290\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-290\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-0454\",\"sourceIdentifier\":\"36106deb-8e95-420b-a0a0-e70af5d245df\",\"published\":\"2024-01-12T02:15:44.867\",\"lastModified\":\"2024-11-21T08:46:37.533\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.\"},{\"lang\":\"es\",\"value\":\"La soluci\u00f3n ELAN Match-on-Chip FPR tiene un error de dise\u00f1o sobre el riesgo potencial de fuga de SID v\u00e1lido y enumeraci\u00f3n con sensor falso. Este fallo hace que el reconocimiento de Windows Hello se omita al clonar el SID para causar una p\u00e9rdida de identidad de la cuenta. La versi\u00f3n inferior a 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) sufrir\u00eda este riesgo en la plataforma DELL Inspiron.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"36106deb-8e95-420b-a0a0-e70af5d245df\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L\",\"baseScore\":6.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":0.5,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"36106deb-8e95-420b-a0a0-e70af5d245df\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-290\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-290\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.0.12011.08009:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D3B550F-D100-4116-AE9F-7F9F203F7B0F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.3.12011.08103:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8BD8D8C7-1B4D-4452-8BC2-6D2B05939AC1\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emc:elan_match-on-chip_fpr_solution:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"02144756-1716-40FF-884B-3E4DD9D2C0A3\"}]}]}],\"references\":[{\"url\":\"https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy\",\"source\":\"36106deb-8e95-420b-a0a0-e70af5d245df\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://github.com/advisories/GHSA-w3jx-33qh-77f8\",\"source\":\"nvd@nist.gov\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T18:04:49.725Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-0454\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-06T17:07:08.650230Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:elan:dell_inspiron:*:*:*:*:*:*:*:*\"], \"vendor\": \"elan\", \"product\": \"dell_inspiron\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.12011.08001\", \"lessThan\": \"3.0.12011.08009\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.3.12011.08101\", \"lessThan\": \"3.3.12011.08103\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-06T17:10:01.403Z\"}}], \"cna\": {\"title\": \"Security Vulnerability on Match-on-Chip FPR Architecture\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6, \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"ELAN\", \"modules\": [\"Windows Hello Identification\"], \"product\": \"DELL Inspiron\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.12011.08001\", \"lessThan\": \"3.0.12011.08009\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.3.12011.08101\", \"lessThan\": \"3.3.12011.08103\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows\"], \"packageName\": \"UMDF Driver\", \"defaultStatus\": \"affected\"}], \"datePublic\": \"2024-01-12T01:30:00.000Z\", \"references\": [{\"url\": \"https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\u003cbr\u003eThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\u003cbr\u003eVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-290\", \"description\": \"CWE-290 Authentication Bypass by Spoofing\"}]}], \"providerMetadata\": {\"orgId\": \"36106deb-8e95-420b-a0a0-e70af5d245df\", \"shortName\": \"ELAN\", \"dateUpdated\": \"2024-01-12T01:48:47.887Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-0454\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-06T17:10:10.844Z\", \"dateReserved\": \"2024-01-12T01:47:40.093Z\", \"assignerOrgId\": \"36106deb-8e95-420b-a0a0-e70af5d245df\", \"datePublished\": \"2024-01-12T01:48:47.887Z\", \"assignerShortName\": \"ELAN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.