Cyber Resilience

CVE-2024-29214

High

Published: 12 February 2025

Published
12 February 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v4 8.7 CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0002 6.4th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-29214 is a high-severity Improper Input Validation (CWE-20) vulnerability in Intel (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique System Firmware (T1542.001); ranked at the 6.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-29214 is an improper input validation vulnerability (CWE-20) in the UEFI firmware component CseVariableStorageSmm, affecting some Intel processors. Published on 2025-02-12, it carries a CVSS v3.1 base score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity with potential for significant impact.

The vulnerability can be exploited by a privileged user with local access, requiring high attack complexity but no user interaction. Successful exploitation may enable escalation of privilege, allowing the attacker to achieve high levels of confidentiality, integrity, and availability impacts across a changed scope.

Intel's security advisory INTEL-SA-01139 details the issue, while Debian LTS has issued an announcement in their mailing list regarding related updates. Practitioners should consult these references for mitigation guidance and patch availability.

EU & UK References

Vulnerability details

Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

CWE(s)
CWE-20

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1542.001 System Firmware Stealth
Adversaries may modify system firmware to persist on systems.
attack.mitre.org →
Why these techniques?

Direct mapping to UEFI/SMM firmware vulnerability enabling local privilege escalation via system firmware exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-33659Shared CWE-20
CVE-2024-0179Shared CWE-20
CVE-2024-28127Shared CWE-20
CVE-2023-34440Shared CWE-20
CVE-2024-24582Shared CWE-20
CVE-2024-21925Shared CWE-20
CVE-2026-2750Shared CWE-20
CVE-2026-22862Shared CWE-20
CVE-2025-27224Shared CWE-20
CVE-2026-21268Shared CWE-20

Affected Assets

Intel
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly enforces input validation at system points, comprehensively addressing the improper input validation flaw in UEFI firmware CseVariableStorageSmm.

SI-2 Flaw Remediation good match
prevent

Requires timely patching and remediation of identified flaws like CVE-2024-29214 in Intel processor firmware.

AC-6 Least Privilege partial match
prevent

Enforces least privilege to restrict escalation beyond the attacker's initial high privileges in the local access scenario.

References