{"id":"CVE-2019-11098","aliases":["DEBIAN-CVE-2019-11098","EUVD-2019-2802","GHSA-6g82-r87x-h953","OESA-2022-1986","OESA-2022-1987","OESA-2022-1988","SUSE-SU-2023:0004-1","SUSE-SU-2023:0036-1","UBUNTU-CVE-2019-11098","USN-5088-1"],"status":"published","title":"Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to...","description":"Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00345,"percentile":0.28247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2021-07-14T13:28:44Z","modified":"2026-10-05T19:19:03Z","fixes":[{"ecosystem":"Debian:12","package":"edk2","fixed_in":["2020.11-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"edk2","fixed_in":["2020.11-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["2020.11-5"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"edk2","fixed_in":["202011-6.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"ovmf","fixed_in":["201911-150200.7.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"ovmf","fixed_in":["201911-150200.7.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"ovmf","fixed_in":["201911-150200.7.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"ovmf","fixed_in":["201911-150200.7.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"ovmf","fixed_in":["201911-150200.7.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"ovmf","fixed_in":["201911-150200.7.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"ovmf","fixed_in":["201911-150200.7.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"ovmf","fixed_in":["202008-150300.10.17.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"edk2","fixed_in":["0~20191122.bd85bf54-2ubuntu3.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-5"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-10.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-10.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-6.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.17.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1","0~20160408.ffea0a2c-2ubuntu0.2+esm3","0~20160408.ffea0a2c-2ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1","0~20180205.c0d9813c-2ubuntu0.3+esm2","0~20180205.c0d9813c-2ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.3"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.3"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2"],"bundled":4}],"products":[{"vendor":"tianocore","product":"edk_ii"}],"references":[{"url":"https://edk2-docs.gitbook.io/security-advisory/bootguard-toctou-vulnerability","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11098","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6g82-r87x-h953"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11098","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14584","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1987","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1988","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230004-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188371","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11098","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230036-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-11098","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5088-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38575","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-11098","description":"Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.","status":"published","published":"2021-07-14T13:28:44Z","modified":"2024-08-04T22:40:16.262Z","updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2019-2802","description":"Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.","status":"published","published":"2021-07-14T13:28:44Z","modified":"2024-08-04T22:40:16Z","updated_at":"2026-11-03T02:40:50.22256Z"}],"ghsa":[{"id":"GHSA-6g82-r87x-h953","title":"Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to...","description":"Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.","status":"published","published":"2022-05-24T19:08:01Z","modified":"2023-01-30T05:00:44Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:46:15.885384Z"}],"nvd":[{"id":"CVE-2019-11098","description":"Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.","status":"published","published":"2021-07-14T14:15:07.937Z","modified":"2026-06-17T02:12:18.353Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-11098","description":"Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.","status":"published","published":"2021-07-14T14:15:07.937Z","modified":"2026-03-14T09:31:48.446993Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-11098","description":"Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.","status":"published","published":"2021-07-14T14:15:07.937Z","modified":"2026-09-21T07:01:25.473003149Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"OESA-2022-1986","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\r\n\r\nNull pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.(CVE-2019-14584)\r\n\r\nInsufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.(CVE-2019-11098)","status":"published","published":"2022-10-14T11:05:18Z","modified":"2026-08-18T01:17:19.942433963Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-1987","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\r\n\r\nNull pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.(CVE-2019-14584)\r\n\r\nInsufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.(CVE-2019-11098)","status":"published","published":"2022-10-14T11:05:18Z","modified":"2026-08-18T01:17:20.023692508Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-1988","title":"edk2 security update","description":"\r\n\r\nSecurity Fix(es):\r\n\r\nInsufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.(CVE-2019-11098)","status":"published","published":"2022-10-14T11:05:18Z","modified":"2026-08-18T01:17:20.01178874Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2019-11098","description":"Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.","status":"published","published":"2021-07-14T14:15:00Z","modified":"2026-10-05T19:19:03.57954588Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"SUSE-SU-2023:0004-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-11098: Fixed insufficient input validation in MdeModulePkg (bsc#1188371).\n","status":"published","published":"2023-01-02T09:32:49Z","modified":"2025-05-02T04:30:03.328521Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0036-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-11098: Fixed insufficient input validation in MdeModulePkg (bsc#1188371).\n","status":"published","published":"2023-01-06T09:00:10Z","modified":"2026-02-04T04:18:46.490505Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5088-1","title":"edk2 vulnerabilities","description":"It was discovered that EDK II incorrectly handled input validation in\nMdeModulePkg. A local user could possibly use this issue to cause EDK II to\ncrash, resulting in a denial of service, obtain sensitive information or\nexecute arbitrary code. (CVE-2019-11098)\n\nPaul Kehrer discovered that OpenSSL used in EDK II incorrectly handled\ncertain input lengths in EVP functions. An attacker could possibly use this\nissue to cause EDK II to crash, resulting in a denial of service.\n(CVE-2021-23840)\n\nIngo Schwarze discovered that OpenSSL used in EDK II incorrectly handled\ncertain ASN.1 strings. An attacker could use this issue to cause EDK II to\ncrash, resulting in a denial of service, or possibly obtain sensitive\ninformation. (CVE-2021-3712)\n\nIt was discovered that EDK II incorrectly decoded certain strings. A remote\nattacker could use this issue to cause EDK II to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2021-38575)\n","status":"published","published":"2021-09-23T11:39:45Z","modified":"2026-04-27T16:03:37.605067471Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}