CVE-2021-38576

Published: Jan 3, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.

Affected (12)

Products: Tianocore: Edk2

Tianocore

1 product

Edk2

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Tianocore Edk2	Version 201808
Tianocore Edk2	Version 201811
Tianocore Edk2	Version 201903
Tianocore Edk2	Version 201905
Tianocore Edk2	Version 201908
Tianocore Edk2	Version 201911
Tianocore Edk2	Version 202002
Tianocore Edk2	Version 202005
Tianocore Edk2	Version 202008
Tianocore Edk2	Version 202011
Tianocore Edk2	Version 202102
Tianocore Edk2	Version 202105

References (3)

https://bugzilla.tianocore.org/show_bug.cgi?id=3499

Source: infosec@edk2.groups.io

Issue TrackingPermissions RequiredThird Party Advisory

https://bugzilla.tianocore.org/show_bug.cgi?id=3499

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPermissions RequiredThird Party Advisory

https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.