https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
It was discovered that EDK II incorrectly handled input validation in MdeModulePkg. A local user could possibly use this issue to cause EDK II to crash, resulting in a denial of service, obtain sensitive information or execute arbitrary code. (CVE-2019-11098) Paul Kehrer discovered that OpenSSL used in EDK II incorrectly handled certain input lengths in EVP functions. An attacker could possibly use this issue to cause EDK II to crash, resulting in a denial of service. (CVE-2021-23840) Ingo Schwarze discovered that OpenSSL used in EDK II incorrectly handled certain ASN.1 strings. An attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2021-3712) It was discovered that EDK II incorrectly decoded certain strings. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-38575)
BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.
Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.
Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.
Reference: https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html
Upstream commits: https://github.com/tianocore/edk2/commit/acebdf14c985c5c9f50b37ece0b15ada87767359 https://github.com/tianocore/edk2/commit/72750e3bf9174f15c17e78f0f117b5e7311bb49f
Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
Last updated 29 July 2024
Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.
In EDK II, a vulnerability exists in BaseUefiDecompressLib.c, TianoCompress.c, and UEFI specification via a heap-based buffer overflow in the Decode() function. An authenticated attacker could exploit this via a crafted file to escalate privileges.
External Reference:
https://edk2-docs.gitbooks.io/security-advisory/content/edk-ii-tianocompress-bounds-checking-issues.html
Upstream Bug:
https://bugzilla.tianocore.org/showbug.cgi?id=686
In EDK II, a vulnerability exists in BaseUefiDecompressLib.c, TianoCompress.c, and UEFI specification via a stack-based buffer overflow in the MakeTable() function. An authenticated attacker could exploit this via a crafted file to escalate privileges.
External Reference:
https://edk2-docs.gitbooks.io/security-advisory/content/edk-ii-tianocompress-bounds-checking-issues.html
Upstream Bug:
https://bugzilla.tianocore.org/showbug.cgi?id=686
In EDK II, a vulnerability exists in BaseUefiDecompressLib.c, TianoCompress.c, and UEFI specification via a heap-based buffer overflow in the MakeTable() function. An authenticated attacker could exploit this via a crafted file to escalate privileges.
External Reference:
https://edk2-docs.gitbooks.io/security-advisory/content/edk-ii-tianocompress-bounds-checking-issues.html
Upstream Bug:
https://bugzilla.tianocore.org/showbug.cgi?id=686
In EDK II, a vulnerability exists in BaseUefiDecompressLib.c (MdePkg/Library/BaseUefiDecompressLib). An authenticated attacker could exploit this via a crafted file to escalate privileges.
External Reference:
https://edk2-docs.gitbooks.io/security-advisory/content/edk-ii-tianocompress-bounds-checking-issues.html
Upstream Bug:
https://bugzilla.tianocore.org/showbug.cgi?id=686
In EDK II, a vulnerability exists in TianoCompress.c (BaseTools/Source/C/TianoCompress) from github/tianocore/edk2. An authenticated attacker could exploit this via a crafted file to escalate privileges.
External Reference:
https://edk2-docs.gitbooks.io/security-advisory/content/edk-ii-tianocompress-bounds-checking-issues.html
Upstream Bug:
https://bugzilla.tianocore.org/showbug.cgi?id=686
A logic error in MdeModulePkg in EDK II firmware may allow authenticated user to potentially bypass configuration access controls and escalate privileges via local access.
External Reference:
https://edk2-docs.gitbooks.io/security-advisory/content/edk-ii-authenticated-variable-bypass.html
Upstream Bug:
https://bugzilla.tianocore.org/showbug.cgi?id=415
A logic error in MdeModulePkg in EDK II firmware may allow authenticated user to potentially bypass configuration access controls and escalate privileges via local access.
External Reference:
https://edk2-docs.gitbooks.io/security-advisory/content/edk-ii-authenticated-variable-bypass.html
Upstream Bug:
https://bugzilla.tianocore.org/showbug.cgi?id=415
Last updated 10 October 2024