#VU56490 Buffer overflow in edk2 - CVE-2021-38575

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU56490

#VU56490 Buffer overflow in edk2 - CVE-2021-38575

Published: September 14, 2021


Vulnerability identifier: #VU56490
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2021-38575
CWE-ID: CWE-119
Exploitation vector: Adjecent network
Exploit availability: No public exploit available
Vulnerable software:
edk2
Software vendor:
TianoCore

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the IScsiHexToBin() function in NetworkPkg/IScsiDxe. A remote attacker with ability to inject data into communication between edk2 and the iSCSI target can execute arbitrary code on the target system.



Remediation

Install updates from vendor's website.

External links