PT-2018-3849 · Intel+1 · Edk Ii+1

Published 2018-08-30 · Updated 2021-01-17 · CVE-2018-12179

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EDK II (affected versions not specified)

Description The issue is related to improper configuration in system firmware for EDK II, which may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure, and/or denial of service via local access. It is also associated with insufficient access control in the open-source UEFI EDK2 development environment. Exploitation of the issue could allow an attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2022-06883

CVE-2018-12179

MGASA-2021-0035

Affected Products

Astra Linux

Edk Ii

References · 20

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP · Vendor Advisory
• https://edk2-docs.gitbooks.io/security-advisory/content/opal-blocksid-setting-disabled-after-s3.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06883 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12179 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0035 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/A23OH3MXQU7WURSP4PC66EXMG6INYFH6 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4684-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12179 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12179 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-12179 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0035.html · Security Note
• https://github.com/tianocore/edk2/releases · Note