PT-2019-6290 · Intel+7 · Edk Ii+7

Published 2019-05-15 · Updated 2024-10-10 · CVE-2021-28211

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EDK II (affected versions not specified)

Description A heap overflow issue exists in the LzmaUefiDecompressGetInfo function. This issue can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

BDU:2022-06901

CESA-2021_2591

CVE-2021-28211

DLA-2645-1

OESA-2021-1338

OPENSUSE-SU-2021:0495-1

OPENSUSE-SU-2021_0495-1

OPENSUSE-SU-2024:11134-1

RHSA-2021:2591

RHSA-2021_2591

RLSA-2021:2591

SUSE-SU-2021:0972-1

SUSE-SU-2021:0987-1

SUSE-SU-2021:2117-1

SUSE-SU-2021:2161-1

USN-4923-1

USN-7060-1

Affected Products

Astra Linux

Centos

Edk Ii

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 118

• 🔥 https://github.com/alcaparra/CVE-2022-1292 · Exploit
• 🔥 https://github.com/li8u99/CVE-2022-1292 · Exploit
• 🔥 https://github.com/rama291041610/CVE-2022-1292 · Exploit
• 🔥 https://github.com/greek0x0/CVE-2022-1292 · Exploit
• 🔥 https://github.com/und3sc0n0c1d0/CVE-2022-1292 · Exploit
• 🔥 https://bugzilla.tianocore.org/show_bug.cgi?id=1816 · Exploit
• https://security-tracker.debian.org/tracker/DLA-2645-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/683494 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2161-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/687311 · Security Note
• https://bdu.fstec.ru/vul/2022-06898 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14559 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38578 · Security Note
• https://osv.dev/vulnerability/OESA-2021-1338 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05454 · Security Note