Anolis OS update for edk2



| Updated: 2025-03-28
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2019-14560
CWE-ID CWE-252
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Anolis OS
Operating systems & Components / Operating system

edk2-tools-doc
Operating systems & Components / Operating system package or component

edk2-ovmf
Operating systems & Components / Operating system package or component

edk2-aarch64
Operating systems & Components / Operating system package or component

Vendor OpenAnolis

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Unchecked Return Value

EUVDB-ID: #VU83486

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-14560

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to an unchecked return value within the DxeImageVerificationHandler() function in SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c. A local user can bypass the secure boot protection.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

edk2-tools-doc: before 20220126gitbb1bba3d77-5

edk2-ovmf: before 20220126gitbb1bba3d77-5

edk2-aarch64: before 20220126gitbb1bba3d77-5

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0063


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###