PT-2021-7868 · Edk2+8 · Edk2+8

Published 2014-10-06 · Updated 2025-06-05 · CVE-2021-38578

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EDK2 (affected versions not specified)

Description The issue is related to a buffer overflow in the SmmEntryPoint function of the open-source UEFI EDK2 development environment. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The existing CommBuffer checks in SmmEntryPoint do not catch underflow when computing BufferSize.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-124

CWE-787

Related Identifiers

ALSA-2023:2165

ALT-PU-2014-2246

ALT-PU-2022-3248

ALT-PU-2022-3249

ALT-PU-2022-3250

ALT-PU-2022-3388

ALT-PU-2022-3389

BDU:2023-03835

CVE-2021-38578

DLA-4207-1

OESA-2022-2122

OPENSUSE-SU-2024:12542-1

RHSA-2023:2165

RHSA-2023_2165

SUSE-SU-2023:1921-1

SUSE-SU-2023:1940-1

SUSE-SU-2023:1941-1

SUSE-SU-2023:1958-1

SUSE-SU-2023:1968-1

SUSE-SU-2023:2234-1

USN-7060-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Debian

Edk2

Linuxmint

Red Hat

Suse

Ubuntu

References · 69

• 🔥 https://github.com/alcaparra/CVE-2022-1292 · Exploit
• 🔥 https://github.com/und3sc0n0c1d0/CVE-2022-1292 · Exploit
• 🔥 https://github.com/greek0x0/CVE-2022-1292 · Exploit
• 🔥 https://github.com/rama291041610/CVE-2022-1292 · Exploit
• 🔥 https://github.com/li8u99/CVE-2022-1292 · Exploit
• https://ubuntu.com/security/CVE-2021-28210 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1968-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1940-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38578 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:2165 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1292 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38578 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-0161 · Vendor Advisory