{
  "document": {
    "aggregate_severity": {
      "text": "niedrig"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Die Firmware ist eine in die Ger\u00e4te fest eingebettete Software, die dort grundlegende Funktionen leistet.\r\nProLiant ist eine Serverfamilie von Hewlett Packard Enterprise.\r\nSynergy ist eine kombinierbare Blade-Infrastruktur, die Workloads in einer Hybrid Cloud-Umgebung unterst\u00fctzt.\r\nLenovo ist ein Hersteller u. a. von Computern.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann eine Schwachstelle in Intel TDX Module Firmware ausnutzen, um Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- BIOS/Firmware",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3126 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3126.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3126 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3126"
      },
      {
        "category": "external",
        "summary": "Intel Security Advisory INTEL-SA-01099 vom 2024-10-08",
        "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01099.html"
      },
      {
        "category": "external",
        "summary": "HPE Security Bulletin HPESBHF04710 rev.1 vom 2024-10-08",
        "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04710en_us\u0026docLocale=en_US"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory LEN-158929 vom 2024-10-08",
        "url": "https://support.lenovo.com/us/en/product_security/LEN-158929"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2024-385 vom 2024-11-12",
        "url": "https://www.dell.com/support/kbdoc/de-de/000247691/dsa-2024-385-dell-poweredge-server-security-update-for-intel-tdx-module-software-vulnerability"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2024-326 vom 2024-12-10",
        "url": "https://www.dell.com/support/kbdoc/de-de/000227013/dsa-2024-326"
      }
    ],
    "source_lang": "en-US",
    "title": "Intel TDX Module Firmware: Schwachstelle erm\u00f6glicht Offenlegung von Informationen",
    "tracking": {
      "current_release_date": "2024-12-10T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-11T09:12:34.778+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-3126",
      "initial_release_date": "2024-10-08T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-10-08T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-11-12T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-12-10T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Dell aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Dell Computer",
            "product": {
              "name": "Dell Computer",
              "product_id": "T036868",
              "product_identification_helper": {
                "cpe": "cpe:/o:dell:dell_computer:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Dell PowerEdge",
            "product": {
              "name": "Dell PowerEdge",
              "product_id": "T036715",
              "product_identification_helper": {
                "cpe": "cpe:/h:dell:poweredge:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "HPE ProLiant",
            "product": {
              "name": "HPE ProLiant",
              "product_id": "T009310",
              "product_identification_helper": {
                "cpe": "cpe:/h:hp:proliant:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "HPE Synergy",
            "product": {
              "name": "HPE Synergy",
              "product_id": "T019820",
              "product_identification_helper": {
                "cpe": "cpe:/h:hpe:synergy:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "HPE"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "TDX Module \u003c1.5.06",
                "product": {
                  "name": "Intel Firmware TDX Module \u003c1.5.06",
                  "product_id": "T038080"
                }
              },
              {
                "category": "product_version",
                "name": "TDX Module 1.5.06",
                "product": {
                  "name": "Intel Firmware TDX Module 1.5.06",
                  "product_id": "T038080-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:intel:firmware:tdx_module__1.5.06"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "Intel"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Lenovo Computer",
            "product": {
              "name": "Lenovo Computer",
              "product_id": "T030470",
              "product_identification_helper": {
                "cpe": "cpe:/h:lenovo:computer:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Lenovo"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-27457",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in der Intel TDX Module Firmware. Die Ursache ist eine unzureichende Pr\u00fcfung auf ungew\u00f6hnliche oder au\u00dfergew\u00f6hnliche Bedingungen. Ein lokaler privilegierter Angreifer kann die Schwachstelle ausnutzen, um Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036715",
          "T019820",
          "T036868",
          "T038080",
          "T030470",
          "T009310"
        ]
      },
      "release_date": "2024-10-08T22:00:00.000+00:00",
      "title": "CVE-2024-27457"
    }
  ]
}