CVE-2019-0160: Buffer Overflow
Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.
Other sources
Buffer overflows on the stack/heap are found in UDF-related codes under MdeModulePkg\Universal\Disk\PartitionDxe\Udf.c and MdeModulePkg\Universal\Disk\UdfDxe. The issue may be triggered with long file name (> 128 characters) or path name (> 256 characters) or with invalid formatted UDF media.
— Red Hat
Buffer overflows were discovered in UDF-related codes under MdeModulePkg\Universal\Disk\PartitionDxe\Udf.c and MdeModulePkg\Universal\Disk\UdfDxe, which could be triggered with long file names or invalid formatted UDF media.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-0160?
CVE-2019-0160 is a vulnerability that allows an unauthenticated user to potentially enable buffer overflow in system firmware for EDK II.
What is the severity of CVE-2019-0160?
The severity of CVE-2019-0160 is critical with a CVSS score of 9.8.
Which software packages are affected by CVE-2019-0160?
The software packages affected by CVE-2019-0160 include ovmf, edk2, Tianocore Edk Ii, openSUSE Leap, Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, and Redhat Enterprise Linux Server Tus.
How can CVE-2019-0160 be exploited?
CVE-2019-0160 can be exploited by triggering buffer overflows in UDF-related codes with long file names or invalid formatted UDF media.
Where can I find more information about CVE-2019-0160?
More information about CVE-2019-0160 can be found in the references provided: https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1683404, https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1683410, https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1683413.