75 matches found
virt-firmware
OVMF / armvirt 固件卷的工具 这是一个用于 edk2 固件镜像的小型工具集合。它们支持解码和打印固件卷的内容。变量存储（OVMFVARS.fd）可以被修改，例如用于注册安全启动证书。 virt-fw-dump 解码并打印固件卷的内容。 用法：virt-fw-dump -i 。 更多信息请尝试 virt-fw-dump --help，包含一些用于过滤输出的选项。 virt-fw-vars 打印和编辑变量存储卷。 目前专注于注册证书和启用安全启动。 打印变量：virt-fw-vars -i --print。 注册证书： virt-fw-vars \ --input ...
CVE-2021-43613
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
CVE-2021-43613 SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
CVE-2021-43613
A vulnerability in the SysPasswordDxe driver of Insyde InsydeH2O 5.x exposes user and administrator password hashes in runtime UEFI variables, enabling privilege escalation . The affected firmware is also used in Siemens SIMATIC industrial products. The CVSS 3.1 score is 6.5 (Medium) with a local...
EUVD-2021-34868
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
CVE-2021-43613 SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
CVE-2021-43613: Incorrect Permission Assignment for Critical Resource
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
PT-2026-84909
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...
CVE-2026-8810 HDD Password leakage vulnerability
On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables...
CVE-2026-8810
On ARM platforms, an architecture-design flaw in HDD Password handling allows an attacker to retrieve the password from UEFI variables. CVSS 6.9 MEDIUM; physical access, high complexity, low privileges required. Exploitation details not provided in the documents.
EUVD-2026-62294
On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables...
CVE-2026-8810: Insufficiently Protected Credentials
On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables...
PT-2026-78308
On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables...
ALPINE-CVE-2025-58151
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The...
CVE-2025-58151
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The...
CVE-2025-58151
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The...
CVE-2025-58151 varstored: TOCTOU issues with mapped guest memory
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The...
CVE-2022-35897
An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker modifies specific UEFI variables, it can cause a stack overflow, leading to arbitrary code execution. The specific variables are normally...
CVE-2024-39707
Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible roll-back attack in certain platforms. This is fixed in: kernel 5.2, version 05.29.19; kernel 5.3, version 05.38.19; kernel 5.4, version...