REDHAT-BUG-1686783: Buffer Overflow

Published Mar 8, 2019

Updated

A stack buffer overflow was found in edk2 when the HII database contains a Bitmap who claims as 4-bit or 8-bit per pixel, but the palette contains more than 16(2^4) or 256(2^8) colors.

Upstream issue:

https://bugzilla.tianocore.org/showbug.cgi?id=1135

References:

https://lists.01.org/pipermail/edk2-devel/2019-March/037626.html

Affected Software

1 affected component

Tianocore edk2

Event History

Mar 8, 2019

Data Sourced

via Red Hat·10:07 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1686783?

The severity of REDHAT-BUG-1686783 is critical due to the potential for a stack buffer overflow.

How do I fix REDHAT-BUG-1686783?

To mitigate REDHAT-BUG-1686783, ensure that bitmap palettes contain a valid number of colors corresponding to their specified bit depth.

What software is affected by REDHAT-BUG-1686783?

REDHAT-BUG-1686783 affects the TianoCore edk2 software.

What type of vulnerability is REDHAT-BUG-1686783?

REDHAT-BUG-1686783 is classified as a stack buffer overflow vulnerability.

What conditions lead to REDHAT-BUG-1686783?

REDHAT-BUG-1686783 occurs when the HII database contains a bitmap with an incorrect palette claiming more colors than the specified bits.