PT-2024-6777 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an integer overflow in the Resume Extensible Firmware Interface of Microsoft Windows operating systems. This allows an attacker to bypass the UEFI Secure Boot...

PT-2024-6778 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows Resume Extensible Firmware Interface affected versions not specified Description: The issue is related to a security-feature bypass vulnerability in the Resume Extensible Firmware Interface of Microsoft Windows operating systems. It...

AZL-49713 CVE-2024-38796 affecting package hvloader for versions less than 1.0.1-13

EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage. An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability...

There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables

...

PT-2024-7323 · Intel +1 · Intel Uefi Firmware +1

Name of the Vulnerable Software and Affected Versions: Intel UEFI Firmware affected versions not specified Description: The issue is related to improper input validation in the UEFI firmware of certain Intel processors. This flaw may allow a privileged user to potentially enable escalation of...

PT-2024-7299 · Intel · Intel Uefi Firmware

Name of the Vulnerable Software and Affected Versions: Intel UEFI firmware affected versions not specified Description: A race condition in the UEFI firmware for some Intel processors may allow a privileged user to potentially enable escalation of privilege via local access. This issue is caused ...

The vulnerability of UEFI microprogramming, which is related to the possibility of using hard-coded platform keys, allows a hacker to execute arbitrary code before the operating system loads.

The vulnerability of UEFI BIOS relates to the possibility of using hard-coded platform keys. Exploiting this vulnerability allows a hacker to execute arbitrary code before the operating system loads...

The vulnerability of the efi component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the efi component in the Linux operating system’s kernel is related to the assignment of NULL pointers. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a failure to check for the existence of efi.getvariable before calling it...

DEBIAN-CVE-2022-48879

In the Linux kernel, the following vulnerability has been resolved: efi: fix NULL-deref in init error path In cases where runtime services are not supported or have been disabled, the runtime services workqueue will never have been allocated. Do not try to destroy the workqueue unconditionally in...

UBUNTU-CVE-2023-52893

In the Linux kernel, the following vulnerability has been resolved: gsmi: fix null-deref in gsmigetvariable We can get EFI variables without fetching the attribute, so we must allow for that in gsmi. commit 859748255b43 "efi: pstore: Omit efivars caching EFI varstore access layer" added a new...

UBUNTU-CVE-2022-48879

In the Linux kernel, the following vulnerability has been resolved: efi: fix NULL-deref in init error path In cases where runtime services are not supported or have been disabled, the runtime services workqueue will never have been allocated. Do not try to destroy the workqueue unconditionally in...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a null pointer dereference issue in the gsmi component when fetching EFI variables...

kernel: efi: fix panic in kdump kernel

In the Linux kernel, the following vulnerability has been resolved: efi: fix panic in kdump kernel The Linux kernel CVE team has assigned CVE-2024-35800 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051738-CVE-2024-35800-219a@gregkh/T...

August 13, 2024—KB5041580 (OS Builds 19044.4780 and 19045.4780) - EXPIRED

None None...

PT-2024-11951 · Asp +1 · Asp +1

Name of the Vulnerable Software and Affected Versions: ASP affected versions not specified Description: The issue is related to incomplete cleanup in the ASP, which may expose the Master Encryption Key MEK to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfiltrati...

kernel: efi: runtime: Fix potential overflow of soft-reserved region size

A flaw was found in the Linux kernel. Due to an integer overflow, certain EFI-related memory reservations might receive a size other than expected, leading to a denial of service...

kernel: efi: runtime: Fix potential overflow of soft-reserved region size

A flaw was found in the Linux kernel. Due to an integer overflow, certain EFI-related memory reservations might receive a size other than expected, leading to a denial of service...

edk2: Predictable TCP Initial Sequence Numbers

A security flaw has been identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker to potentially disclose sensitive information...

CVE-2022-48769

In the Linux kernel, the following vulnerability has been resolved: efi: runtime: avoid EFIv2 runtime services on Apple x86 machines Aditya reports 0 that his recent MacbookPro crashes in the firmware when using the variable services at runtime. The culprit appears to be a call to...