USN-5088-1: EDK II vulnerabilities
It was discovered that EDK II incorrectly handled input validation in MdeModulePkg. A local user could possibly use this issue to cause EDK II to crash, resulting in a denial of service, obtain sensitive information or execute arbitrary code. (CVE-2019-11098) Paul Kehrer discovered that OpenSSL used in EDK II incorrectly handled certain input lengths in EVP functions. An attacker could possibly use this issue to cause EDK II to crash, resulting in a denial of service. (CVE-2021-23840) Ingo Schwarze discovered that OpenSSL used in EDK II incorrectly handled certain ASN.1 strings. An attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2021-3712) It was discovered that EDK II incorrectly decoded certain strings. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-38575)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-5088-1?
The severity of USN-5088-1 is significant, as it can lead to denial of service, exposure of sensitive information, or arbitrary code execution.
How do I fix USN-5088-1?
To fix USN-5088-1, update the affected packages to the specified remedial versions such as 2020.11-4ubuntu0.1 for Ubuntu 21.04.
Which software is affected by USN-5088-1?
USN-5088-1 affects multiple packages including qemu-efi, QEMU EFi for ARM, and OVMF across Ubuntu 21.04 and 20.04.
Could USN-5088-1 allow unauthorized access?
Yes, USN-5088-1 could potentially enable a local user to execute arbitrary code, leading to unauthorized access.
What is the impact of not addressing USN-5088-1?
Failure to address USN-5088-1 can result in system crashes, denial of service, and potential exposure of sensitive information.