PT-2025-19374 · Debian · Debian

Dann Frazier · Published 2025-04-28 · Updated 2026-01-03 · CVE-2025-2486

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ubuntu edk2 UEFI firmware packages versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 Ubuntu edk2 UEFI firmware packages (affected versions not specified)

Description The Ubuntu edk2 UEFI firmware packages unintentionally permitted access to the UEFI Shell within Secure Boot environments, potentially circumventing Secure Boot protections. Earlier versions included a secure-boot-based mechanism to maintain operation within the Shell, which is considered adequate for enforcing Secure Boot restrictions. This issue represents an additional correction related to a previous incomplete fix.

Recommendations Update to version 2024.05-2ubuntu0.3. Update to version 2024.02-2ubuntu0.3. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-489

Related Identifiers

CVE-2025-2486

Affected Products

Debian

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-2486 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2486 · Vendor Advisory
• https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2101797 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-2486 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2486 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-2486 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2486 · Vendor Advisory
• https://t.me/msrcreports/2398 · Telegram Post
• https://t.me/msrcreports/2887 · Telegram Post
• https://twitter.com/CVEnew/status/1993739363751219542 · Twitter Post
• https://t.me/CVEtracker/38302 · Telegram Post
• https://t.me/msrcreports/2589 · Telegram Post
• https://t.me/msrcreports/2521 · Telegram Post