dbcve.org
CWE-1264Weakness · CWE-1264

CVE-2024-21823

HIGH · 7.5 CVSS v3.1 Published 2024-05-16
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
77/100
Remediation priority · High
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

A hardware logic vulnerability in Intel(R) DSA (Data Streaming Accelerator) and Intel(R) IAA (In-Memory Analytics Accelerator) in 4th and 5th generation Xeon(R) processors involves insecure de-synchronization. This could allow an authorized local user to escalate privileges by exploiting the timing/state mismatch in hardware logic.

MitigationApply Intel microcode and firmware updates (BIOS/UEFI) from the server OEM for affected Xeon processors; verify processor model is within the affected generations.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify your processor model
    Run 'lscpu | grep -E "Model name|CPU(s)"' or check /proc/cpuinfo to determine the exact CPU model number (e.g., Xeon Gold 6430, Xeon Platinum 8480+)
    Affected if The CPU model indicates a 4th generation (Codename Sapphire Rapids) or 5th generation (Codename Emerald Rapids) Intel Xeon processor family
  2. Determine CPU generation from model number
    Cross-reference the CPU model number against Intel's Xeon processor generation naming: 4th gen Xeon starts with Xeon Gold/Silver/Bronze 4xxx or Xeon Platinum 5xxx; 5th gen Xeon uses similar numbering with Emerald Rapids codename
    Affected if The processor is confirmed as a 4th or 5th generation Xeon based on model naming convention
  3. Check if Intel DSA accelerator is present
    Check for DSA device presence via 'ls -la /sys/bus/dsa/devices/' or query kernel DSA configuration via 'cat /sys/class/dsa/dsa0/status' if available; also check dmesg for DSA driver loading messages
    Affected if Intel DSA is enumerated and active on the system (device appears in sysfs or driver loads successfully)
  4. Check if Intel IAA accelerator is present
    Check for IAA device presence via 'ls -la /sys/bus/iaa/devices/' or query kernel IAA configuration via 'cat /sys/class/iaa/iaa0/status' if available; also check dmesg for IAA driver loading messages
    Affected if Intel IAA is enumerated and active on the system (device appears in sysfs or driver loads successfully)

You are affected if your system runs a 4th or 5th generation Intel Xeon processor AND has Intel DSA or IAA hardware present and enabled in the BIOS/operating system.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply Intel microcode and firmware updates (BIOS/UEFI) from the server OEM for affected Xeon processors; verify processor model is within the affected generations.

Recommended fix Moderate confidence

Intel microcode update (contact system manufacturer for specific BIOS/firmware version)

  1. Check your system manufacturer for BIOS/firmware updates that include Intel microcode addressing CVE-2024-21823
  2. For Linux systems, ensure the intel-microcode package is updated to the latest version
  3. Apply OS-level microcode updates: on RHEL/Fedora run 'dnf update' or 'yum update' to receive microcode patches
  4. For Windows systems, check Windows Update for the latest Intel microcode updates
  5. Verify the processor is 4th or 5th generation Intel Xeon (Scalable processors) using 'lscpu' or system information tools
  6. Contact your hardware vendor or Intel support if no update is available to confirm remediation timeline
Caveat Microcode updates are generally low-risk but may require system reboot; test in staging environment first

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-21823 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-21823 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data