CVE-2024-21853
Raw vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2024-21853 is a medium-severity Improper Finite State Machines (FSMs) in Hardware Logic (CWE-1245) vulnerability in Intel (inferred from references). Its CVSS base score is 5.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-24 (Fail in Known State) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19464
Vulnerability Data
Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authorized user to potentially enable denial of service via local access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation at post-design stages can discover undefined or insecure FSM states through simulation and formal verification.
Forcing a transition to a known safe state on failure limits the impact of an attacker-driven undefined FSM state.
Requiring the developer to produce a security architecture and design description forces explicit FSM modeling and review before implementation.
Security engineering principles applied during hardware design directly reduce the chance of introducing faulty FSM transitions or unreachable states.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices and verification throughout the lifecycle directly prevent faulty FSM implementations in hardware logic.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can discover undefined FSM states before deployment.
Secure development lifecycle includes hardware design reviews that can catch FSM flaws.
Secure system architecture and engineering principles directly address proper FSM design and state validation.
Secure coding guidelines can extend to hardware description languages to prevent FSM coding errors.
Change management ensures hardware logic modifications do not introduce new FSM weaknesses.