CVE-2021-28216

mediumpriority · track · 31EPSS 0.004 · 36 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.42% (36th) EPSS

CVSS 4.6 · medium

Is it mine?

12 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.6–7.8

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 3.9 · impact 6.4

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-763USprimaryCWE-587USCWE-763US

affected products (12)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
EMC Avamarall versionscert_bundDEcpe:/a:emc:avamar:-
Lenovo BIOSall versionscert_bundDEcpe:/h:lenovo:bios:-
Tianocore EDK II≤ EDK II Masterenisa_euvdEU
Tianocore edk2≤ 202111-rc1fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 4.7fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 9fstec_bduRU
tianocore edk iiall versionsnvdUScpe:2.3:a:tianocore:edk_ii:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-1421Lenovo BIOS: Mehrere Schwachstellen ermöglichen CodeausführungDeutsch2022-09-13csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen im Lenovo BIOS ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd NVD CVE.org MITRE

published 2021-08-05modified 2026-06-17

related (171)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2013-4695US	high7.8	5.28% (93rd)	Exploit	2019-12-27
Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution
CVE-2022-23222US	high7.8	1.92% (80th)	Exploit	2022-01-14
kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer type…
CVE-2021-41073US	high7.8	1.77% (78th)	Exploit	2021-09-19
loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer,…
CVE-2026-31787US	high7.8	0.18% (8th)	Exploit	2026-04-30
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may…
CVE-2023-34312US	high7.8	0.60% (48th)	Exploit	2023-06-01
In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication, which leads to a wri…

+166 more

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan