Every CVE Search/ Get API key

CVE-2017-5731

Red Hat Security Advisory: ovmf security and enhancement update

7.8 HighFix available

CVE-2017-5731 is a high vulnerability (CVSS 7.8) in Tianocore Edk2, published December 17, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in OVMF 0:20180508-6.gitee3198e672e2.el7.

Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.39%Unchanged since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.

Record
CVE-2017-5731
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.

Record
CVE-2017-5731
Updated
2026-11-02
EUVDEUVD-2017-14808 No score

Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.

Record
EUVD-2017-14808
Updated
2026-11-03
OSVRHSA-2019:2125 6.7

Red Hat Security Advisory: ovmf security and enhancement update

Record
RHSA-2019:2125
CVSS 3.0
6.7 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-5731 7.8

Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.

Record
UBUNTU-CVE-2017-5731
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:11134-1 No score

ovmf-202105-3.4 on GA media

These are all security issues fixed in the ovmf-202105-3.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11134-1
Updated
2026-11-02
Show 4 moreShow less
OSVSUSE-SU-2018:4155-1 No score

Security update for ovmf

This update for ovmf fixes the following issues:

Security issues fixed:

  • CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916).
  • CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917).
  • CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917).
  • CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917).

Non security issues fixed:

  • Fixed an issue with the default owner of PK/KEK/db/dbx and make the auto-enrollment only happen at the very first time. (bsc#1117998)
Record
SUSE-SU-2018:4155-1
Updated
2026-11-02
OSVSUSE-SU-2018:4194-1 No score

Security update for ovmf

This update for ovmf fixes the following issues:

Security issues fixed:

  • CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916).
  • CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917).
  • CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917).
  • CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917).

Non security issues fixed:

  • Fixed an issue with the default owner of PK/KEK/db/dbx and make the auto-enrollment only happen at the very first time. (bsc#1117998)
Record
SUSE-SU-2018:4194-1
Updated
2026-11-02
OSVSUSE-SU-2018:4207-1 No score

Security update for ovmf

This update for ovmf fixes the following issues:

Security issues fixed:

  • CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916).
  • CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917).
  • CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917).
  • CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917).
Record
SUSE-SU-2018:4207-1
Updated
2026-11-02
OSVUSN-6920-1 No score

edk2 vulnerabilities

It was discovered that EDK II was not properly performing bounds checks in Tianocompress, which could lead to a buffer overflow. An authenticated user could use this issue to potentially escalate their privileges via local access. (CVE-2017-5731)

It was discovered that EDK II had an insufficient memory write check in the SMM service, which could lead to a page fault occurring. An authenticated user could use this issue to potentially escalate their privileges, disclose information and/or create a denial of service via local access. (CVE-2018-12182)

It was discovered that EDK II incorrectly handled memory in DxeCore, which could lead to a stack overflow. An unauthenticated user could this issue to potentially escalate their privileges, disclose information and/or create a denial of service via local access. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-12183)

It was discovered that EDK II incorrectly handled memory in the Variable service under certain circumstances. An authenticated user could use this issue to potentially escalate their privileges, disclose information and/or create a denial of service via local access. (CVE-2018-3613)

It was discovered that EDK II incorrectly handled memory in its system firmware, which could lead to a buffer overflow. An unauthenticated user could use this issue to potentially escalate their privileges and/or create a denial of service via network access. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-0160)

Record
USN-6920-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
OVMF
Red Hat:enterprise_linux:7::server
 before 0:20180508-6.gitee3198e672e2.el7
0:20180508-6.gitee3198e672e2.el7
ovmf
Red Hat:enterprise_linux:7::server
 before 0:20180508-6.gitee3198e672e2.el7
0:20180508-6.gitee3198e672e2.el7
ovmf
SUSE:Linux Enterprise Module for Server Applications 15
 before 2017+git1510945757.b2662641d5-5.11.1
2017+git1510945757.b2662641d5-5.11.1
ovmf
SUSE:Linux Enterprise Desktop 12 SP4
 before 2017+git1510945757.b2662641d5-3.5.1
2017+git1510945757.b2662641d5-3.5.1
ovmf
SUSE:Linux Enterprise Server 12 SP4
 before 2017+git1510945757.b2662641d5-3.5.1
2017+git1510945757.b2662641d5-3.5.1
ovmf
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 2017+git1510945757.b2662641d5-3.5.1
2017+git1510945757.b2662641d5-3.5.1
ovmf
SUSE:Linux Enterprise Server 12 SP3
 before 2017+git1492060560.b6d11d7c46-4.17.1
2017+git1492060560.b6d11d7c46-4.17.1
ovmf
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2017+git1492060560.b6d11d7c46-4.17.1
2017+git1492060560.b6d11d7c46-4.17.1
edk2
Ubuntu:Pro:16.04:LTS
 before 0~20160408.ffea0a2c-2ubuntu0.2+esm1, plus listed versions
0~20150106.5c2d456b-20~20160104.c2a892d7-10~20160408.ffea0a2c-20~20160408.ffea0a2c-2ubuntu0.10~20160408.ffea0a2c-2ubuntu0.2
0~20160408.ffea0a2c-2ubuntu0.2+esm1
edk2
Ubuntu:Pro:18.04:LTS
 before 0~20180205.c0d9813c-2ubuntu0.3+esm1, plus listed versions
0~20170911.5dfba97c-10~20171010.234dbcef-10~20171027.76fd5a66-10~20171205.a9212288-10~20180105.0bc94c74-1
Show 5 moreShow less
0~20180205.c0d9813c-10~20180205.c0d9813c-20~20180205.c0d9813c-2ubuntu0.10~20180205.c0d9813c-2ubuntu0.20~20180205.c0d9813c-2ubuntu0.3
0~20180205.c0d9813c-2ubuntu0.3+esm1
ovmf
openSUSE:Tumbleweed
 before 202105-3.4
202105-3.4

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, NVD, OSV

References

Show 81 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open