CVE-2021-28211

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.

Security Fix(es):

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.(CVE-2021-28211)

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

• edk2: possible heap corruption with LzmaUefiDecompressGetInfo (CVE-2021-28211)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.

This update for ovmf fixes the following issues:

• CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)
• CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the ovmf-202105-3.4 package on the GA media of openSUSE Tumbleweed.

This update for ovmf fixes the following issues:

• CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)
• CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)

This update for ovmf fixes the following issues:

• CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)
• CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)

This update for ovmf fixes the following issues:

• Fixed a possible buffer overflow in IScsiDxe (bsc#1186151)
• CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)
• CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)
• CVE-2019-14584: ovmf,shim: NULL pointer dereference in AuthenticodeVerify() (bsc#1177789)

This update for ovmf fixes the following issues:

• Fixed a possible buffer overflow in IScsiDxe (bsc#1186151)
• CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)
• CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)

Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. (CVE-2021-28210)

Satoshi Tanda discovered that EDK II incorrectly handled decompressing certain images. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-28211)

It was discovered that EDK II did not check the buffer length in XHCI, which could lead to a stack overflow. A local attacker could potentially use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-0161)

Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28210)

Satoshi Tanda discovered that EDK II incorrectly handled decompressing certain images. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28211)

It was discovered that EDK II incorrectly decoded certain strings. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-38575)

It was discovered that EDK II had integer underflow vulnerability in SmmEntryPoint, which could result in a buffer overflow. An attacker could potentially use this issue to cause a denial of service. (CVE-2021-38578)

Elison Niven discovered that OpenSSL, vendored in EDK II, incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run. This issue only affected Ubuntu 16.04 LTS. (CVE-2022-1292)