Every CVE Search/ Get API key

CVE-2024-31157

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may...

6.8 MediumFix available

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.23%Up 0.2 points since Feb 13, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.8

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Record
CVE-2024-31157
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-665
Updated
2026-11-02
EUVDEUVD-2025-4959 6.8

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Record
EUVD-2025-4959
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-7jpp-9623-r487 6.8

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may...

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Record
GHSA-7jpp-9623-r487
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-665
Updated
2026-11-02
NVD 6.8

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Record
CVE-2024-31157
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-665
Updated
2026-11-02
OSVDEBIAN-CVE-2024-31157 6.8

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Record
DEBIAN-CVE-2024-31157
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2025-1171 8.2

microcode_ctl security update

This is a tool to transform and deploy microcode update for x86 CPUs.

Security Fix(es):

Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2023-34440)

Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2023-43758)

Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to potentially enable escalation of privilege via local access.(CVE-2024-24582)

Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.(CVE-2024-28047)

Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2024-28127)

Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2024-29214)

Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via local access.(CVE-2024-31068)

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.(CVE-2024-31157)

Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access.(CVE-2024-36293)

Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable denial of service via local access.(CVE-2024-37020)

Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access.(CVE-2024-39279)

Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of service via local access.(CVE-2024-39355)

Record
OESA-2025-1171
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVRHEA-2025:3114 8.2

Red Hat Enhancement Advisory: microcode_ctl bug fix and enhancement update

Record
RHEA-2025:3114
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:7043 6.5

Red Hat Security Advisory: microcode_ctl security update

Record
RHSA-2025:7043
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:7043 6.5

Moderate: microcode_ctl security update

The microcode_ctl packages provide microcode updates for Intel and AMD processors.

Security Fix(es):

  • microcode_ctl: Improper input validation in UEFI firmware (CVE-2024-28047)

  • microcode_ctl: Insufficient granularity of access control in UEFI firmware (CVE-2024-39279)

  • microcode_ctl: mproper initialization in UEFI firmware OutOfBandXML module (CVE-2024-31157)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Record
RLSA-2025:7043
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-31157 6.8

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Record
UBUNTU-CVE-2024-31157
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2025:7043 No score

Moderate: microcode_ctl security update

The microcode_ctl packages provide microcode updates for Intel and AMD processors.

Security Fix(es):

  • microcode_ctl: Improper input validation in UEFI firmware (CVE-2024-28047)
  • microcode_ctl: Insufficient granularity of access control in UEFI firmware (CVE-2024-39279)
  • microcode_ctl: mproper initialization in UEFI firmware OutOfBandXML module (CVE-2024-31157)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Record
ALSA-2025:7043
Updated
2026-11-02
OSVCLSA-2025-1757692837 No score

microcode_ctl: Fix of 9 CVEs

  • Update Intel CPU microcode to 20250812, addresses: CVE-2024-28047, CVE-2024-31157, CVE-2024-39279, CVE-2024-28956, CVE-2024-43420, CVE-2024-45332, CVE-2025-24495, CVE-2025-20623, CVE-2025-20012
    • Addition of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at revision 0x2c000401;
    • Addition of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at revision 0x2b000643;
    • Addition of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat) at revision 0x3a;
    • Addition of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in microcode.dat) at revision 0x437;
    • Addition of cpuid:A06D1/0x20 (GNR-AP/SP H0) microcode (in microcode.dat) at revision 0xa000100;
    • Addition of cpuid:A06D1/0x95 (GNR-AP/SP B0) microcode (in microcode.dat) at revision 0x10003d0;
    • Addition of cpuid:B0650/0x80 (ARL-U A1) microcode (in microcode.dat) at revision 0xa;
    • Addition of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) at revision 0x12f;
    • Addition of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in microcode.dat) at revision 0x4129;
    • Addition of cpuid:B06D1/0x80 (LNL B0) microcode (in microcode.dat) at revision 0x123;
    • Addition of cpuid:C0652/0x82 (ARL-H A1) microcode (in microcode.dat) at revision 0x119;
    • Addition of cpuid:C0662/0x82 (ARL-HX 8P/S B0) microcode (in microcode.dat) at revision 0x119;
    • Addition of cpuid:C0664/0x82 microcode (in microcode.dat) at revision 0x119;
    • Addition of cpuid:C06A2/0x82 microcode (in microcode.dat) at revision 0x119;
    • Addition of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at revision 0x210002b3;
    • Removal of cpuid:50656/0xbf (CLX-SP B0) microcode (in microcode.dat) at revision 0x4003605;
    • Removal of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at revision 0x2c0003e0;
    • Removal of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at revision 0x2b000620;
    • Removal of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat) at revision 0x38;
    • Removal of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in microcode.dat) at revision 0x436;
    • Removal of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) at revision 0x12c;
    • Removal of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in microcode.dat) at revision 0x4124;
    • Removal of cpuid:C06F1/0x87 (EMR-SP A0) microcode (in microcode.dat) at revision 0x21000291;
    • Removal of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at revision 0x21000291;
    • Update of cpuid:50657/0xbf (CLX-SP/W/X B1/L1) microcode (in microcode.dat) from revision 0x5003707 up to 0x5003901;
    • Update of cpuid:5065B/0xbf (CPX-SP A1) microcode (in microcode.dat) from revision 0x7002904 up to 0x7002b01;
    • Update of cpuid:606A6/0x87 (ICX-SP D0) microcode (in microcode.dat) from revision 0xd0003f5 up to 0xd000410;
    • Update of cpuid:606C1/0x10 (ICL-D B0) microcode (in microcode.dat) from revision 0x10002c0 up to 0x10002e0;
    • Update of cpuid:706A8/0x01 (GLK-R R0) microcode (in microcode.dat) from revision 0x24 up to 0x26;
    • Update of cpuid:706E5/0x80 (ICL-U/Y D1) microcode (in microcode.dat) from revision 0xc6 up to 0xca;
    • Update of cpuid:806C1/0x80 (TGL-UP3/UP4 B1) microcode (in microcode.dat) from revision 0xb8 up to 0xbc;
    • Update of cpuid:806C2/0xc2 (TGL-R C0) microcode (in microcode.dat) from revision 0x38 up to 0x3c;
    • Update of cpuid:806D1/0xc2 (TGL-H R0) microcode (in microcode.dat) from revision 0x52 up to 0x56;
    • Update of cpuid:806EC/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in microcode.dat) from revision 0xfc up to 0x100;
    • Update of cpuid:806F4/0x10 microcode (in microcode.dat) from revision 0x2c0003e0 up to 0x2c000401;
    • Update of cpuid:806F4/0x87 (SPR-SP E0/S1) microcode (in microcode.dat) from revision 0x2b000620 up to 0x2b000643;
    • Update of…
Record
CLSA-2025-1757692837
Updated
2026-11-02
OSV No score

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Record
CVE-2024-31157
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
microcode_ctl
AlmaLinux:9
From an advisory covering 3 CVEs
 before 4:20250211-1.el9_6
4:20250211-1.el9_6
microcode_ctl
TuxCare:AlmaLinux:9.2
From an advisory covering 9 CVEs
 before 4:20220809-2.20250812.1.el9_2.tuxcare.els1
4:20220809-2.20250812.1.el9_2.tuxcare.els1
intel-microcode
Debian:12
 before 3.20250211.1~deb12u1, plus listed versions
0.20080131-10.20080220-10.20080401-10.20080910-10.20080910-2
Show 45 moreShow less
0.20090330-10.20090927-10.20100826-10.20100914-10.20101123-10.20110428-10.20110915-10.20111110-10.20120606-11.20120606.11.20120606.21.20120606.31.20120606.41.20120606.51.20120606.61.20120606.6~bpo60+11.20120606.v2.11.20120606.v2.21.20120606.v2.2~bpo60+11.20130222.11.20130222.1~bpo60+11.20130222.31.20130222.41.20130222.51.20130222.61.20130808.11.20130808.21.20130906.11.20140122.11.20140122.1~bpo60+11.20140430.11.20140430.1~bpo60+11.20140624.11.20140624.1~bpo60+11.20140913.11.20140913.1~bpo60+11.20150121.12.20130808.12.20130808.1~bpo70+12.20130906.12.20130906.1~bpo70+12.20140122.12.20140122.1~bpo70+12.20140430.12.20140430.1~bpo70+1
3.20250211.1~deb12u1
intel-microcode
Debian:13
 before 3.20250211.1, plus listed versions
0.20080131-10.20080220-10.20080401-10.20080910-10.20080910-2
Show 45 moreShow less
0.20090330-10.20090927-10.20100826-10.20100914-10.20101123-10.20110428-10.20110915-10.20111110-10.20120606-11.20120606.11.20120606.21.20120606.31.20120606.41.20120606.51.20120606.61.20120606.6~bpo60+11.20120606.v2.11.20120606.v2.21.20120606.v2.2~bpo60+11.20130222.11.20130222.1~bpo60+11.20130222.31.20130222.41.20130222.51.20130222.61.20130808.11.20130808.21.20130906.11.20140122.11.20140122.1~bpo60+11.20140430.11.20140430.1~bpo60+11.20140624.11.20140624.1~bpo60+11.20140913.11.20140913.1~bpo60+11.20150121.12.20130808.12.20130808.1~bpo70+12.20130906.12.20130906.1~bpo70+12.20140122.12.20140122.1~bpo70+12.20140430.12.20140430.1~bpo70+1
3.20250211.1
intel-microcode
Debian:14
 before 3.20250211.1, plus listed versions
0.20080131-10.20080220-10.20080401-10.20080910-10.20080910-2
Show 45 moreShow less
0.20090330-10.20090927-10.20100826-10.20100914-10.20101123-10.20110428-10.20110915-10.20111110-10.20120606-11.20120606.11.20120606.21.20120606.31.20120606.41.20120606.51.20120606.61.20120606.6~bpo60+11.20120606.v2.11.20120606.v2.21.20120606.v2.2~bpo60+11.20130222.11.20130222.1~bpo60+11.20130222.31.20130222.41.20130222.51.20130222.61.20130808.11.20130808.21.20130906.11.20140122.11.20140122.1~bpo60+11.20140430.11.20140430.1~bpo60+11.20140624.11.20140624.1~bpo60+11.20140913.11.20140913.1~bpo60+11.20150121.12.20130808.12.20130808.1~bpo70+12.20130906.12.20130906.1~bpo70+12.20140122.12.20140122.1~bpo70+12.20140430.12.20140430.1~bpo70+1
3.20250211.1
intel-microcode
Debian:11
From an advisory covering 12 CVEs
 before 3.20250211.1~deb11u1, plus listed versions
0.20080131-10.20080220-10.20080401-10.20080910-10.20080910-2
Show 45 moreShow less
0.20090330-10.20090927-10.20100826-10.20100914-10.20101123-10.20110428-10.20110915-10.20111110-10.20120606-11.20120606.11.20120606.21.20120606.31.20120606.41.20120606.51.20120606.61.20120606.6~bpo60+11.20120606.v2.11.20120606.v2.21.20120606.v2.2~bpo60+11.20130222.11.20130222.1~bpo60+11.20130222.31.20130222.41.20130222.51.20130222.61.20130808.11.20130808.21.20130906.11.20140122.11.20140122.1~bpo60+11.20140430.11.20140430.1~bpo60+11.20140624.11.20140624.1~bpo60+11.20140913.11.20140913.1~bpo60+11.20150121.12.20130808.12.20130808.1~bpo70+12.20130906.12.20130906.1~bpo70+12.20140122.12.20140122.1~bpo70+12.20140430.12.20140430.1~bpo70+1
3.20250211.1~deb11u1
microcode_ctl
openEuler:20.03-LTS-SP4
From an advisory covering 12 CVEs
 before 20250211-1.oe2003sp4
20250211-1.oe2003sp4
microcode_ctl
openEuler:22.03-LTS-SP3
From an advisory covering 12 CVEs
 before 20250211-1.oe2203sp3
20250211-1.oe2203sp3
microcode_ctl
openEuler:22.03-LTS-SP4
From an advisory covering 12 CVEs
 before 20250211-1.oe2203sp4
20250211-1.oe2203sp4
microcode_ctl
openEuler:24.03-LTS
From an advisory covering 12 CVEs
 before 20250211-1.oe2403sp1
20250211-1.oe2403sp1
Show 4 moreShow less
Affected packages
PackageAffectedFixed
microcode_ctl
openEuler:24.03-LTS-SP1
From an advisory covering 12 CVEs
 before 20250211-1.oe2403sp1
20250211-1.oe2403sp1
microcode_ctl
Red Hat:enterprise_linux:8::baseos
From an advisory covering 10 CVEs
 before 4:20250211-1.el8_10
4:20250211-1.el8_10
microcode_ctl
Red Hat:enterprise_linux:9::baseos
From an advisory covering 3 CVEs
 before 4:20250211-1.el9_6
4:20250211-1.el9_6
microcode_ctl
Rocky Linux:9
From an advisory covering 3 CVEs
 before 4:20250211-1.el9_6
4:20250211-1.el9_6

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-31157 is a medium vulnerability (CVSS 6.8) in microcode_ctl, published February 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in intel-microcode 3.20250211.1~deb12u1.

References

Show 59 moreShow less
This page doesn't list everything

Left out here: 585 versions and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open