Code execution in edk2



| Updated: 2023-01-02
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2019-11098
CWE-ID CWE-20
Exploitation vector Local
Public exploit N/A
Vulnerable software
 edk2
Hardware solutions / Firmware

Vendor TianoCore

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Input validation error

EUVDB-ID: #VU70612

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11098

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows an attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in MdeModulePkg. An attacker with physical access to the affected system can execute arbitrary code.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

edk2: All versions

CPE2.3 External links

https://edk2-docs.gitbook.io/security-advisory/bootguard-toctou-vulnerability


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###