CVE-2024-33657

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMRAM to kernel space, potentially leading to denial-of-service attacks.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Aug 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-336587.8APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buff CVE-2024-336598.8AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Successful exploit CVE-2024-33669.8A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of t CVE-2024-336604.3An exploit is possible where an actor with physical access can manipulate SPI flash without being detected.CVE-2024-336619.1Portainer before 2.20.0 allows redirects when the target is not index.yaml.CVE-2024-336627.5Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.CVE-2024-336636.5python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.CVE-2024-336645.3python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryp CVE-2024-336656.1angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. NOTE: the vendor indicates that there CVE-2024-336668.6An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this t CVE-2024-336676.5An issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack by calling an endpoin CVE-2024-336689.1An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An a