Tianocore: >> Edk2 Security Vulnerabilities
EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
CVSS Score
7.0
EPSS Score
0.0
Published
2024-01-09
EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
CVSS Score
7.0
EPSS Score
0.0
Published
2024-01-09
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
CVSS Score
7.4
EPSS Score
0.001
Published
2022-03-03
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.
CVSS Score
7.5
EPSS Score
0.002
Published
2022-01-03
NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.
CVSS Score
8.1
EPSS Score
0.006
Published
2021-12-01
An unlimited recursion in DxeCore in EDK II.
CVSS Score
7.8
EPSS Score
0.001
Published
2021-06-11
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.
CVSS Score
6.7
EPSS Score
0.001
Published
2021-06-11
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.
CVSS Score
7.5
EPSS Score
0.004
Published
2021-06-11
Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score
7.8
EPSS Score
0.001
Published
2021-06-03
Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access.
CVSS Score
8.0
EPSS Score
0.001
Published
2020-11-23