REDHAT-BUG-2459982: Medium severity rhboot efivar (libefiboot) vulnerability
A stack overflow vulnerability was found in libefiboot (part of efivar). The device path node parser does not validate that each node Length field is >= 4 bytes (minimum EFI device path node header size) before recursing. A crafted node with Length < 4 causes infinite recursion in efiloadoptisvalid() -> efiloadoptoptionaldatasize(), leading to stack exhaustion and process crash.
Upstream: github.com/rhboot/efivar - no Issues tab or SECURITY.md available. This report serves as initial upstream notification. Suggested fix: Add minimum length guard: if (dp->length < 4) return -1;
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2459982?
The severity of REDHAT-BUG-2459982 is medium with a score of 4.
What type of vulnerability is REDHAT-BUG-2459982?
REDHAT-BUG-2459982 is a stack overflow vulnerability found in libefiboot.
How does the stack overflow occur in REDHAT-BUG-2459982?
The stack overflow in REDHAT-BUG-2459982 occurs due to the device path node parser not validating node Length fields before recursing.
What products are affected by REDHAT-BUG-2459982?
The products affected by REDHAT-BUG-2459982 include rhboot and efivar (libefiboot).
How can I mitigate the effects of REDHAT-BUG-2459982?
To mitigate REDHAT-BUG-2459982, ensure that your system is updated to address the stack overflow vulnerability in libefiboot.