CVSS: 8.1EPSS: 0%CPEs: 7EXPL: 1CVE-2021-38575 – edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe
https://notcve.org/view.php?id=CVE-2021-38575
NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. NetworkPkg/IScsiDxe presenta unos desbordamientos de búfer explotables de forma remota A flaw was found in edk2. Missing checks in the IScsiHexToBin function in NetworkPkg/IScsiDxe lead to a buffer overflow allowing a remote attacker, who can inject himself in the communication between edk2 and the iSCSI target, to write arbitrary data to any address in the edk2 firmware and potentially execute code. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. • https://bugzilla.tianocore.org/show_bug.cgi?id=3356 https://www.insyde.com/security-pledge/SA-2023025 https://access.redhat.com/security/cve/CVE-2021-38575 https://bugzilla.redhat.com/show_bug.cgi?id=1956284 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-124: Buffer Underwrite ('Buffer Underflow') •
CVSS: 7.2EPSS: 0%CPEs: 39EXPL: 0CVE-2020-27339
https://notcve.org/view.php?id=CVE-2020-27339
In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt either the firmware or the OS memory. The fixed versions for this issue in the AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe drivers are 05.16.25, 05.26.25, 05.35.25, 05.43.25, and 05.51.25 (for Kernel 5.1 through 5.5). En el kernel de Insyde InsydeH2O 5.x, algunos controladores SMM no validaban correctamente los parámetros CommBuffer y CommBufferSize, lo que permitía a los llamantes corromper el firmware o la memoria del sistema operativo. Las versiones corregidas para este problema en los controladores AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe y SdMcDeviceDxe son 05.16.25, 05.26.25, 05.35.25, 05.43.25 y 05.51.25 (para los núcleos 5.1 a 5.5) • https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf https://security.netapp.com/advisory/ntap-20220216-0005 https://www.insyde.com/security-pledge/SA-2021001 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2019-12532
https://notcve.org/view.php?id=CVE-2019-12532
Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08. El control de acceso inadecuado en las herramientas de software de Insyde puede permitir que un usuario autenticado permita potencialmente la escalada de privilegios o la divulgación de información a través del acceso local. Esta es una vulnerabilidad de software, no un problema de firmware. • https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered https://security.netapp.com/advisory/ntap-20220223-0004 https://www.insyde.com/security-pledge/SA-2019001 •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2005-4175
https://notcve.org/view.php?id=CVE-2005-4175
Insyde BIOS V190 does not clear the keyboard buffer after reading the BIOS password during system startup, which allows local administrators or users to read the password directly from physical memory. Insyde BIOS V190 no borra el búfer del teclado después de leer la contraseña de la BIOS durante el arranque del sistema, lo que permite a administradores o usuarios locales leer directamente la contraseña de la memoria física. • http://www.ivizsecurity.com/preboot-patch.html http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf http://www.kb.cert.org/vuls/id/847537 http://www.pulltheplug.org/users/endrazine/Bios.Information.Leakage.txt http://www.securityfocus.com/archive/1/419610/100/0/threaded http://www.securityfocus.com/bid/15751 •