Edk2
Monthly
Pre-boot remote code execution in the TianoCore EDK II PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) lets an unauthenticated network attacker corrupt DXE-phase memory on any machine that is PXE-booting over IPv4 or IPv6, writing attacker-controlled bytes past the fixed 504-byte Mode.IcmpError field in the driver's private context. The reliable outcome is a DXE-core exception and hang that denies OS provisioning or recovery; escalation to arbitrary ring-0 code execution before Secure Boot or measured boot has verified anything requires the attacker to know the exact target firmware build so a counterfeit event can be planted for CoreSignalEvent() dispatch. No CISA KEV entry and no public exploit code were identified at time of analysis, but the vuln.today decision label is act_now and this is a genuine high-priority issue because the vulnerable receive path is open by default during network boot.
The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Rated low severity (CVSS 3.7), this vulnerability is no authentication required.
EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Rated high severity (CVSS 7.0). No vendor patch available.
EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Rated high severity (CVSS 7.0). No vendor patch available.
EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Rated high severity (CVSS 7.0). No vendor patch available.
NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An unlimited recursion in DxeCore in EDK II. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Pre-boot remote code execution in the TianoCore EDK II PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) lets an unauthenticated network attacker corrupt DXE-phase memory on any machine that is PXE-booting over IPv4 or IPv6, writing attacker-controlled bytes past the fixed 504-byte Mode.IcmpError field in the driver's private context. The reliable outcome is a DXE-core exception and hang that denies OS provisioning or recovery; escalation to arbitrary ring-0 code execution before Secure Boot or measured boot has verified anything requires the attacker to know the exact target firmware build so a counterfeit event can be planted for CoreSignalEvent() dispatch. No CISA KEV entry and no public exploit code were identified at time of analysis, but the vuln.today decision label is act_now and this is a genuine high-priority issue because the vulnerable receive path is open by default during network boot.
The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Rated low severity (CVSS 3.7), this vulnerability is no authentication required.
EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Rated high severity (CVSS 7.0). No vendor patch available.
EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Rated high severity (CVSS 7.0). No vendor patch available.
EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Rated high severity (CVSS 7.0). No vendor patch available.
NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An unlimited recursion in DxeCore in EDK II. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.