CVE-2024-26022

Improper access control in some IntelR UEFI Integrator Tools on Aptio V for IntelR NUC may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-26022

Improper access control in some IntelR UEFI Integrator Tools on Aptio V for IntelR NUC may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-26022

CVE-2024-26022 : Improper access control in Intel® UEFI Integrator Tools on Aptio V for Intel® NUC may allow an authenticated user to escalate privileges via local access. Affected products (Intel® Aptio V UEFI Firmware Integrator Tools for NUC) include iSetupCfgWin/Lnx, iFlashVLnx/iFlashVWin, iD...

RHEL 8 : edk2 (RHSA-2024:5297)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5297 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware f...

CVE-2023-20518

Incomplete cleanup in the ASP may expose the Master Encryption Key MEK to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfiltration vulnerability, potentially resulting in loss of confidentiality...

CVE-2023-20578

A TOCTOU Time-Of-Check-Time-Of-Use in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary code execution...

CVE-2021-46772

Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM causing an out of bounds memory read and write, potentially resulting in memory corruption or denial of service...

CVE-2021-26387

Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity...

CVE-2023-20578

CVE-2023-20578 describes a TOCTOU in SMM that could allow a ring-0 attacker with BIOS menu/UEFI shell access to modify a communications buffer and potentially execute arbitrary code. Connected documents confirm this vulnerability in the AMD Secure Processor (ASP) / Platform Initialization (PI) co...

CVE-2023-20578

A TOCTOU Time-Of-Check-Time-Of-Use in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary code execution...

CVE-2023-20518

Incomplete cleanup in the ASP may expose the Master Encryption Key MEK to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfiltration vulnerability, potentially resulting in loss of confidentiality...

CVE-2023-20518

CVE-2023-20518 describes an incomplete cleanup in the AMD Secure Processor (ASP) that could expose the Master Encryption Key (MEK) to a privileged attacker with BIOS/UEFI access, leading to potential confidentiality loss. The vulnerability spans ASP, SEV, and SEV-SNP related firmware; exploitatio...

CVE-2023-20518

Incomplete cleanup in the ASP may expose the Master Encryption Key MEK to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfiltration vulnerability, potentially resulting in loss of confidentiality...

CVE-2021-46772

Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM causing an out of bounds memory read and write, potentially resulting in memory corruption or denial of service...

CVE-2021-46772

Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM causing an out of bounds memory read and write, potentially resulting in memory corruption or denial of service...

CVE-2021-46772

Summary: CVE-2021-46772 describes insufficient input validation in the ABL that may allow a privileged attacker with BIOS/UEFI access to tamper with SPI ROM headers, causing out-of-bounds reads/writes and memory corruption or DoS. The Connected documents provide concrete mitigation details from A...

CVE-2021-26387

CVE-2021-26387 describes insufficient access controls in the AMD ASP kernel that could allow a privileged attacker with access to AMD signing keys and BIOS/UEFI shell to map DRAM regions into protected areas, risking platform integrity. Public documents indicate this CVE is tracked within AMD sec...

CVE-2021-26387

Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity...

CVE-2021-26387

Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity...

Moderate: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...