CVE-2024-0454

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0454
ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 5.2

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/advisories/GHSA-w3jx-33qh-77f8 Third Party Advisory
https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy Not Applicable
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.0.12011.08009:*:*:*:*:*:*:*
cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.3.12011.08103:*:*:*:*:*:*:*
cpe:2.3:h:emc:elan_match-on-chip_fpr_solution:-:*:*:*:*:*:*:*
History

22 Jan 2024, 16:10

Type Values Removed Values Added
References
  • () https://github.com/advisories/GHSA-w3jx-33qh-77f8 - Third Party Advisory
References () https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy - () https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy - Not Applicable
CPE cpe:2.3:h:emc:elan_match-on-chip_fpr_solution:-:*:*:*:*:*:*:*
cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.0.12011.08009:*:*:*:*:*:*:*
cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.3.12011.08103:*:*:*:*:*:*:*
First Time Emc elan Match-on-chip Fpr Solution
Emc
Emc elan Match-on-chip Fpr Solution Firmware
CVSS v2 : unknown
v3 : 6.0 		v2 : unknown
v3 : 6.1

12 Jan 2024, 13:47

Type Values Removed Values Added
Summary
  • (es) La solución ELAN Match-on-Chip FPR tiene un error de diseño sobre el riesgo potencial de fuga de SID válido y enumeración con sensor falso. Este fallo hace que el reconocimiento de Windows Hello se omita al clonar el SID para causar una pérdida de identidad de la cuenta. La versión inferior a 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) sufriría este riesgo en la plataforma DELL Inspiron.

12 Jan 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-12 02:15

Updated : 2024-01-22 16:10

NVD link : CVE-2024-0454

Mitre link : CVE-2024-0454

CVE.ORG link : CVE-2024-0454

JSON object : View

Products Affected

emc

  • elan_match-on-chip_fpr_solution
  • elan_match-on-chip_fpr_solution_firmware
CWE
CWE-290

Authentication Bypass by Spoofing