OESA-2026-4840: efivar security update
Some command line interface of the UEFI variables tools are offered by . Security Fix(es):
A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).(CVE-2026-6862)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/efivarto a version that resolves this vulnerability.Fixed in 38-9.oe2403sp4
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems with the affected efivar/libefiboot component installed are exposed to local denial of service. Exploitation requires a local user to supply a specially crafted EFI device path node to a vulnerable command-line interface.
What does an attacker need to do to trigger the crash?
The attacker needs to provide a device path node whose Length field is smaller than the 4-byte minimum EFI device path node header size. The parser can then recurse indefinitely until stack exhaustion crashes the process.
Does this vulnerability allow data theft or modification?
The provided severity vector indicates no confidentiality or integrity impact. The stated impact is process crash and denial of service through stack exhaustion.