Corey Kallenberg

**Name of the Vulnerable Software and Affected Versions** Tianocore EDK2 versions prior to SVN 16280 **Description** The issue is related to a buffer overflow in the Reclaim function, allowing physically proximate attackers to gain privileges via a long variable name. **Recommendations** For versions prior to SVN 16280, update to a version after SVN 16280 to resolve the issue. As a temporary workaround, consider restricting access to the Reclaim function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** EDK2 (affected versions not specified) **Description** The issue concerns multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation. This allows physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EDK2 (affected versions not specified) **Description** The issue is related to an integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation. This allows physically proximate attackers to bypass intended access restrictions via crafted data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Dell Latitude E6430 BIOS version A09 HP EliteBook 850 G1 BIOS version L71 Ver. 01.09 Description: The System Management Mode (SMM) implementation in certain BIOS versions does not ensure that function calls operate on SMRAM memory locations. This allows local users to bypass the Secure Boot protection mechanism and gain privileges by leveraging write access to physical memory. Recommendations: For Dell Latitude E6430 BIOS version A09, update the BIOS to a version that fixes this issue. For HP EliteBook 850 G1 BIOS version L71 Ver. 01.09, update the BIOS to a version that fixes this issue. As a temporary workaround, consider restricting physical memory access to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple Mac EFI versions before 2015-002 OS X versions prior to 10.11.1 **Description** The issue is related to errors in the code of the EFI module in Mac OS X, which can be exploited by a remote attacker to access undeclared functions. The vulnerability is caused by the mishandling of arguments, allowing attackers to reach unused functions via unspecified vectors. **Recommendations** For Apple Mac EFI versions before 2015-002, update to version 2015-002 or later. For OS X versions prior to 10.11.1, update to OS X 10.11.1 or later.

**Name of the Vulnerable Software and Affected Versions** OS X versions prior to 10.11 **Description** The issue is related to errors in specifying the range of protected registers in the EFI component of the operating system. This can be exploited by an attacker to cause a denial of service, potentially leading to a boot failure, by using a specially crafted application that writes to an unintended address. **Recommendations** For OS X versions prior to 10.11, update to version 10.11 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Dell Latitude, OptiPlex, Precision Mobile Workstation, and Precision Workstation Client Solutions (CS) devices with model-dependent firmware before A21 **Description** The BIOS implementation does not enforce a BIOS CNTL locking protection mechanism upon being woken from sleep, allowing local users to conduct EFI flash attacks by leveraging console access. **Recommendations** For Dell Latitude, OptiPlex, Precision Mobile Workstation, and Precision Workstation Client Solutions (CS) devices with model-dependent firmware before A21, update the firmware to version A21 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple Mac EFI versions before 2015-001 OS X versions prior to 10.10.4 **Description** The issue allows local users to conduct EFI flash attacks by leveraging root privileges, due to the lack of a locking protection mechanism when the system is woken from sleep. **Recommendations** For Apple Mac EFI versions before 2015-001, update to version 2015-001 or later. For OS X versions prior to 10.10.4, update to OS X version 10.10.4 or later.

**Name of the Vulnerable Software and Affected Versions** Dell BIOS versions (affected versions not specified) **Description** The issue allows local users to bypass intended BIOS signing requirements and install arbitrary BIOS images by leveraging administrative privileges. This is achieved by providing a crafted `rbu packet.pktNum` value in conjunction with a crafted `rbu packet.pktSize` value, exploiting a buffer overflow in the Dell BIOS. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.