{"id":"CVE-2021-38575","aliases":["DEBIAN-CVE-2021-38575","DLA-4207-1","EUVD-2021-25017","GHSA-7cjm-mv56-4mg4","OESA-2021-1358","RHSA-2021:3066","RHSA-2021:3172","RHSA-2021:3235","RHSA-2021:3369","RLSA-2021:3066","UBUNTU-CVE-2021-38575","USN-5088-1","USN-7060-1"],"status":"published","title":"NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.","description":"NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01994,"percentile":0.80867,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-124"],"published":"2021-08-10T11:59:49Z","modified":"2026-10-24T10:30:35Z","fixes":[{"ecosystem":"Debian:12","package":"edk2","fixed_in":["2021.08-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"edk2","fixed_in":["2021.08-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["2021.08-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"edk2","fixed_in":["202002-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"edk2","fixed_in":["202002-6.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"edk2","fixed_in":["0:20190308git89910a39dcfd-6.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"edk2-aarch64","fixed_in":["0:20190308git89910a39dcfd-6.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"edk2-ovmf","fixed_in":["0:20190308git89910a39dcfd-6.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"edk2","fixed_in":["0:20190829git37eef91017ad-9.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"edk2-aarch64","fixed_in":["0:20190829git37eef91017ad-9.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"edk2-ovmf","fixed_in":["0:20190829git37eef91017ad-9.el8_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"edk2","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","fixed_in":["0~20160408.ffea0a2c-2ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","fixed_in":["0~20180205.c0d9813c-2ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"edk2","fixed_in":["0~20191122.bd85bf54-2ubuntu3.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.08-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.08-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.08-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-2+deb11u3"}]}],"versions":["2020.11-2","2020.11-2+deb11u1","2020.11-2+deb11u2"],"bundled":16},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-6.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190308git89910a39dcfd-6.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190308git89910a39dcfd-6.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190308git89910a39dcfd-6.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"redhat-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.7-20210804.0.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"redhat-virtualization-host-image-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.7-20210804.0.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190829git37eef91017ad-9.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190829git37eef91017ad-9.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190829git37eef91017ad-9.el8_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20160408.ffea0a2c-2ubuntu0.2+esm3"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180205.c0d9813c-2ubuntu0.3+esm2"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.3"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.3"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20160408.ffea0a2c-2ubuntu0.2+esm3"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180205.c0d9813c-2ubuntu0.3+esm2"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.6"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.3"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2"],"bundled":6}],"products":[{"vendor":"insyde","product":"kernel"},{"vendor":"tianocore","product":"edk ii"},{"vendor":"tianocore","product":"edk2"}],"references":[{"url":"https://bugzilla.tianocore.org/show_bug.cgi?id=3356","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://www.insyde.com/security-pledge/SA-2023025","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38575","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7cjm-mv56-4mg4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-38575","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1358","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3066","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956284","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3066.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-38575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38575","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3172","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3172.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3235","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1965461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971651","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1975142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1975177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989397","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3235.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3609","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3609","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3609","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2021/06/19/1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3621","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3621","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3621","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22543","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22543","tags":["advisory"]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-7wq5-phmq-m584","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22555","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22555","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22555","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=b29c457a6511435960115c0f548c4360d5f4801d","tags":["article"]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3369","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3369.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3066","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-38575","tags":["report"]},{"url":"https://edk2.groups.io/g/devel/message/76198","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5088-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7060-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-11098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-0161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1292","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-38575","description":"NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.","status":"published","published":"2021-12-01T00:00:00Z","modified":"2025-11-03T19:26:13.152Z","cwes":["CWE-124"],"updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-25017","description":"NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.","status":"published","published":"2021-12-01T00:00:00Z","modified":"2025-11-03T19:26:13Z","updated_at":"2026-11-02T19:49:34.152725Z"}],"ghsa":[{"id":"GHSA-7cjm-mv56-4mg4","title":"NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.","description":"NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.","status":"published","published":"2021-12-02T00:00:36Z","modified":"2025-11-03T21:31:40Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-124"],"updated_at":"2026-11-02T15:04:18.722049Z"}],"nvd":[{"id":"CVE-2021-38575","description":"NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.","status":"published","published":"2021-12-01T18:15:07.76Z","modified":"2026-06-17T04:02:23.547Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-124","CWE-119"],"updated_at":"2026-11-02T14:07:01.811115Z"}],"osv":[{"id":"CVE-2021-38575","description":"NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.","status":"published","published":"2021-12-01T18:15:07.76Z","modified":"2026-10-24T10:30:35.152900631Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-38575","description":"NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.","status":"published","published":"2021-12-01T18:15:07.76Z","modified":"2026-10-23T18:03:31.83231435Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2021-1358","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in edk2. Missing checks in the IScsiHexToBin function in NetworkPkg/IScsiDxe lead to a buffer overflow allowing a remote attacker, who can inject himself in the communication between edk2 and the iSCSI target, to write arbitrary data to any address in the edk2 firmware and potentially execute code. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-38575)","status":"published","published":"2021-09-30T11:04:37Z","modified":"2026-08-18T01:16:01.663462585Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:3066","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-09-16T06:08:29Z","modified":"2025-11-22T12:23:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3172","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-09-16T06:08:36Z","modified":"2025-11-22T12:23:38Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3235","title":"Red Hat Security Advisory: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.7]","status":"published","published":"2024-09-16T06:08:42Z","modified":"2026-08-26T10:01:53Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3369","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-09-16T06:08:48Z","modified":"2025-11-22T12:24:10Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:3066","title":"Important: edk2 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe (BZ#1956284)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-08-10T11:59:49Z","modified":"2026-02-05T13:00:06.256409Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-38575","description":"NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.","status":"published","published":"2021-09-14T00:00:00Z","modified":"2026-02-04T04:15:49.721455Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"DLA-4207-1","title":"edk2 - security update","status":"published","published":"2025-06-02T00:00:00Z","modified":"2026-03-09T01:21:23.402813Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"USN-5088-1","title":"edk2 vulnerabilities","description":"It was discovered that EDK II incorrectly handled input validation in\nMdeModulePkg. A local user could possibly use this issue to cause EDK II to\ncrash, resulting in a denial of service, obtain sensitive information or\nexecute arbitrary code. (CVE-2019-11098)\n\nPaul Kehrer discovered that OpenSSL used in EDK II incorrectly handled\ncertain input lengths in EVP functions. An attacker could possibly use this\nissue to cause EDK II to crash, resulting in a denial of service.\n(CVE-2021-23840)\n\nIngo Schwarze discovered that OpenSSL used in EDK II incorrectly handled\ncertain ASN.1 strings. An attacker could use this issue to cause EDK II to\ncrash, resulting in a denial of service, or possibly obtain sensitive\ninformation. (CVE-2021-3712)\n\nIt was discovered that EDK II incorrectly decoded certain strings. A remote\nattacker could use this issue to cause EDK II to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2021-38575)\n","status":"published","published":"2021-09-23T11:39:45Z","modified":"2026-04-27T16:03:37.605067471Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-7060-1","title":"edk2 vulnerabilities","description":"It was discovered that EDK II did not check the buffer length in XHCI, \nwhich could lead to a stack overflow. A local attacker could potentially\nuse this issue to cause a denial of service. This issue only affected \nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-0161)\n\nLaszlo Ersek discovered that EDK II incorrectly handled recursion. A\nremote attacker could possibly use this issue to cause EDK II to consume\nresources, leading to a denial of service. This issue only affected \nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28210)\n\nSatoshi Tanda discovered that EDK II incorrectly handled decompressing\ncertain images. A remote attacker could use this issue to cause EDK II to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n(CVE-2021-28211)\n\nIt was discovered that EDK II incorrectly decoded certain strings. A remote\nattacker could use this issue to cause EDK II to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only \naffected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-38575)\n\nIt was discovered that EDK II had integer underflow vulnerability in \nSmmEntryPoint, which could result in a buffer overflow. An attacker\ncould potentially use this issue to cause a denial of service.\n(CVE-2021-38578)\n\nElison Niven discovered that OpenSSL, vendored in EDK II, incorrectly \nhandled the c_rehash script. A local attacker could possibly use this \nissue to execute arbitrary commands when c_rehash is run. This issue \nonly affected Ubuntu 16.04 LTS. (CVE-2022-1292)\n","status":"published","published":"2024-10-10T03:41:37Z","modified":"2026-06-25T13:32:29.224935972Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}