70 matches found
virt-firmware
ovmf / armvirt ファームウェアボリューム向けツール これは edk2 ファームウェアイメージ向けの小さなツール集です。ファームウェアボリュームの内容をデコードして表示する機能を提供します。 変数ストア OVMFVARS.fd は変更可能で、例えばセキュアブート証明書を登録するために使用できます。 virt-fw-dump ファームウェアボリュームの内容をデコードして表示します。 使い方: virt-fw-dump -i 。 詳細は virt-fw-dump --help を試してください。出力をフィルタリングするオプションがいくつかあります。 virt-fw-vars...
CVE-2021-43613
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
CVE-2021-43613 SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
EUVD-2021-34868
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
CVE-2021-43613 SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
CVE-2021-43613
A vulnerability in the SysPasswordDxe driver of Insyde InsydeH2O 5.x exposes user and administrator password hashes in runtime UEFI variables, enabling privilege escalation . The affected firmware is also used in Siemens SIMATIC industrial products. The CVSS 3.1 score is 6.5 (Medium) with a local...
CVE-2021-43613: Incorrect Permission Assignment for Critical Resource
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
PT-2026-84909
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
EUVD-2026-62294
On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables...
CVE-2026-8810
On ARM platforms, an architecture-design flaw in HDD Password handling allows an attacker to retrieve the password from UEFI variables. CVSS 6.9 MEDIUM; physical access, high complexity, low privileges required. Exploitation details not provided in the documents.
CVE-2026-8810 HDD Password leakage vulnerability
On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables...
PT-2026-78308
On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables...
CVE-2026-8810: Insufficiently Protected Credentials
On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables...
CVE-2025-58151
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The...
ALPINE-CVE-2025-58151
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The...
CVE-2025-58151 varstored: TOCTOU issues with mapped guest memory
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The...
CVE-2025-58151
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The...
CVE-2022-35897
An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker modifies specific UEFI variables, it can cause a stack overflow, leading to arbitrary code execution. The specific variables are normally...
CVE-2024-39707
Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible roll-back attack in certain platforms. This is fixed in: kernel 5.2, version 05.29.19; kernel 5.3, version 05.38.19; kernel 5.4, version...