USN-7060-1

Dashboard / Vulnerabilities / USN-7060-1

USN-7060-1

Summary: edk2 vulnerabilities

Details: It was discovered that EDK II did not check the buffer length in XHCI, which could lead to a stack overflow. A local attacker could potentially use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-0161) Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28210) Satoshi Tanda discovered that EDK II incorrectly handled decompressing certain images. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28211) It was discovered that EDK II incorrectly decoded certain strings. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-38575) It was discovered that EDK II had integer underflow vulnerability in SmmEntryPoint, which could result in a buffer overflow. An attacker could potentially use this issue to cause a denial of service. (CVE-2021-38578) Elison Niven discovered that OpenSSL, vendored in EDK II, incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run. This issue only affected Ubuntu 16.04 LTS. (CVE-2022-1292)

References: https://ubuntu.com/security/notices/USN-7060-1, https://ubuntu.com/security/CVE-2019-0161, https://ubuntu.com/security/CVE-2021-28210, https://ubuntu.com/security/CVE-2021-28211, https://ubuntu.com/security/CVE-2021-38575, https://ubuntu.com/security/CVE-2021-38578, https://ubuntu.com/security/CVE-2022-1292