High
Security advisory
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-38576
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:30 UTC · Revision 1
Source evidence
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.
osv:CVE-2021-38576
Complete source record
{
"id": "802e97e6aab17d3b2cc31204c29bb2b9fa58e48794f06a572a12e8997f014cb6",
"url": "https://osv.dev/vulnerability/CVE-2021-38576",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-38576",
"summary": "A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.",
"evidence": "osv:CVE-2021-38576",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-38576",
"aliases": [
"CVE-2021-38576"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/tianocore/edk2",
"type": "GIT",
"events": [
{
"introduced": "cb5f4f45ce1fca390b99dae5c42b9c4c8b53deea"
},
{
"last_affected": "e1999b264f1f9d7230edf2448f757c73da567832"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:tianocore:edk2:201808:*:*:*:*:*:*:*",
"range": [
{
"introduced": "201808"
},
{
"last_affected": "201808"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:201811:*:*:*:*:*:*:*",
"range": [
{
"introduced": "201811"
},
{
"last_affected": "201811"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:201903:*:*:*:*:*:*:*",
"range": [
{
"introduced": "201903"
},
{
"last_affected": "201903"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:201905:*:*:*:*:*:*:*",
"range": [
{
"introduced": "201905"
},
{
"last_affected": "201905"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:201908:*:*:*:*:*:*:*",
"range": [
{
"introduced": "201908"
},
{
"last_affected": "201908"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:201911:*:*:*:*:*:*:*",
"range": [
{
"introduced": "201911"
},
{
"last_affected": "201911"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:202002:*:*:*:*:*:*:*",
"range": [
{
"introduced": "202002"
},
{
"last_affected": "202002"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:202005:*:*:*:*:*:*:*",
"range": [
{
"introduced": "202005"
},
{
"last_affected": "202005"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:202008:*:*:*:*:*:*:*",
"range": [
{
"introduced": "202008"
},
{
"last_affected": "202008"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:202011:*:*:*:*:*:*:*",
"range": [
{
"introduced": "202011"
},
{
"last_affected": "202011"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:202102:*:*:*:*:*:*:*",
"range": [
{
"introduced": "202102"
},
{
"last_affected": "202102"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:tianocore:edk2:202105:*:*:*:*:*:*:*",
"range": [
{
"introduced": "202105"
},
{
"last_affected": "202105"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"201808",
"201811",
"201903",
"201905",
"201908",
"201911",
"202002",
"202005",
"202008",
"202011",
"202102",
"202105",
"edk2-stable202105",
"edk2-stable202102",
"edk2-stable202011",
"edk2-stable202008",
"edk2-stable202005",
"edk2-stable202002",
"edk2-stable201911",
"edk2-stable201908",
"edk2-stable201905",
"edk2-stable201903",
"edk2-stable201811",
"edk2-stable201808"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38576.json"
}
}
],
"modified": "2026-10-24T10:30:19.267763548Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html",
"https://bugzilla.tianocore.org/show_bug.cgi?id=3499"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-38576",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 429978,
"published_at": "2022-01-03T22:15:09.903+00:00"
}