edk2: Privilege escalation via heap-based buffer overflow in MakeTable() function

🗓️ 06 Aug 2019 12:11:30Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

Authenticated attacker can exploit a heap overflow in the MakeTable function to escalate privileges with a crafted file.

Reporter	Title	Published	Views	Family All 52
Tenable Nessus	Amazon Linux 2 : edk2 (ALAS-2019-1273)	28 Aug 201900:00	–	nessus
Tenable Nessus	CentOS 7 : ovmf (CESA-2019:2125)	30 Aug 201900:00	–	nessus
Tenable Nessus	MiracleLinux 7 : ovmf-20180508-6.gitee3198e672e2.el7 (AXSA:2019-4031:02)	16 Jan 202600:00	–	nessus
Tenable Nessus	NewStart CGSL CORE 5.04 / MAIN 5.04 : ovmf Multiple Vulnerabilities (NS-SA-2019-0218)	2 Dec 201900:00	–	nessus
Tenable Nessus	NewStart CGSL CORE 5.05 / MAIN 5.05 : ovmf Multiple Vulnerabilities (NS-SA-2019-0239)	31 Dec 201900:00	–	nessus
Tenable Nessus	NewStart CGSL CORE 5.05 / MAIN 5.05 : ovmf Multiple Vulnerabilities (NS-SA-2021-0180)	27 Oct 202100:00	–	nessus
Tenable Nessus	NewStart CGSL CORE 5.04 / MAIN 5.04 : ovmf Multiple Vulnerabilities (NS-SA-2022-0009)	9 May 202200:00	–	nessus
Tenable Nessus	openSUSE Security Update : ovmf (openSUSE-2018-1590)	24 Dec 201800:00	–	nessus
Tenable Nessus	openSUSE Security Update : ovmf (openSUSE-2018-1591)	24 Dec 201800:00	–	nessus
Tenable Nessus	openSUSE Security Update : ovmf (openSUSE-2019-1017)	27 Mar 201900:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	any	ovmf	0:20180508-6.gitee3198e672e2.el7.noarch	OVMF-0:20180508-6.gitee3198e672e2.el7.noarch.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2017-5733
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
edk2-docs	www.edk2-docs.gitbooks.io/security-advisory/content/edk-ii-tianocompress-bounds-checking-issues.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-5733
cve	www.cve.org/CVERecord

28 Jun 2026 09:04Current

7.6High risk

Vulners AI Score7.6

heap overflow make table function base uefi decompression library tiano compress uefi specification privilege escalation