Out-of-bounds write in edk2 - CVE-2021-38578

Vulnerability identifier: #VU75395

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2021-38578

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

Affected software:
edk2
RUGGEDCOM APE1808CLA-P
RUGGEDCOM APE1808 ELAN
RUGGEDCOM APE1808 ELAN CC
RUGGEDCOM APE1808 SAM-L
RUGGEDCOM APE1808 SAM-L CC
RUGGEDCOM APE1808W10 CC
RUGGEDCOM APE1808W10
RUGGEDCOM APE1808LNX CC
RUGGEDCOM APE1808LNX
RUGGEDCOM APE1808CLA-S5 CC
RUGGEDCOM APE1808CLA-S5
RUGGEDCOM APE1808CLA-S3 CC
RUGGEDCOM APE1808 CLOUDCONNECT CC
RUGGEDCOM APE1808CLA-S1 CC
RUGGEDCOM APE1808CLA-S1
RUGGEDCOM APE1808 CLOUDCONNECT
RUGGEDCOM APE1808 CKP CC
RUGGEDCOM APE1808 CKP
RUGGEDCOM APE1808 ADM CC
RUGGEDCOM APE1808CLA-P CC
RUGGEDCOM APE1808 ADM
RUGGEDCOM APE1808CLA-S3
PowerEdge R660
PowerEdge R760
PowerEdge MX760c
PowerEdge C6620
PowerEdge R7625
PowerEdge R7615
PowerEdge R6625
PowerEdge R6615
PowerEdge T150
PowerEdge R250
PowerEdge T350
PowerEdge R350
PowerEdge T550
PowerEdge XR12
PowerEdge XR11
PowerEdge R650XS
PowerEdge R450
PowerEdge R750XS
PowerEdge R550
PowerEdge MX750c
PowerEdge C6520
PowerEdge R650
PowerEdge R750XA
PowerEdge R750
PowerEdge XR4520c
PowerEdge XR4510c
PowerEdge T40
PowerEdge R830
Compute Scale-up Server 3200
HPE ProLiant DL20 Gen11
HPE ProLiant MicroServer Gen11
HPE ProLiant ML30 Gen11
HPE ProLiant DL325 Gen11 Server
HPE ProLiant DL385 Gen11 Server
HPE ProLiant DL365 Gen11 Server
HPE ProLiant DL345 Gen11 Server
Superdome Flex 280 Server
HPE ProLiant DL20 Gen10 Plus server
HPE ProLiant ML30 Gen10 Plus server
HPE ProLiant MicroServer Gen10 Plus v2
HPE Edgeline e920d Server Blade
HPE Edgeline e920t Server Blade
HPE ProLiant DL380 Gen10 Plus server
HPE Apollo 2000 Gen10 Plus System
HPE Apollo 4200 Gen10 Plus System
HPE ProLiant DL360 Gen10 Plus server
HPE ProLiant XL220n Gen10 Plus Server
HPE ProLiant XL290n Gen10 Plus Server
HPE Edgeline e920 Server Blade
HPE ProLiant DL110 Gen10 Plus Telco server
PowerEdge R930
PowerEdge R340
PowerEdge R240
PowerEdge T340
PowerEdge T140
Dell EMC NX440
Precision 7910 Rack
Dell XC630 Hyper-converged Appliance
Dell XC430 Hyper-converged Appliance
Dell XC6320 Hyper-converged Appliance
PowerEdge T630
PowerEdge R730
PowerEdge R730xd
PowerEdge R630
PowerEdge C4130
Dell Storage NX3330
PowerEdge C6320
PowerEdge T130
PowerEdge R230
PowerEdge T330
PowerEdge R330
Dell Storage NX430
Dell Storage NX3230
PowerEdge XE2420
PowerEdge XE7420
PowerEdge XE7440
PowerEdge XR2
PowerEdge MX740C
PowerEdge M640 (for PE VRTX)
PowerEdge M640
PowerEdge FC640
PowerEdge C6420
PowerEdge T640
PowerEdge R840
PowerEdge R740XD2
PowerEdge R940XA
PowerEdge T440
PowerEdge R440
PowerEdge R540
PowerEdge R740
PowerEdge R940
PowerEdge R640
PowerEdge R740XD
PowerEdge C4140
Dell EMC XC Core XCXR2
Dell EMC XC Core XC940 System
Dell EMC XC Core XC740xd System
PowerEdge MX840C
Dell EMC XC Core XC640 System
Dell EMC XC Core 6420 System
Dell EMC Storage NX3340
Dell EMC Storage NX3240
DSS 8440
Precision 7920 Rack
HPE Synergy 480 Gen11 Compute Module
HPE Alletra 4120
HPE Alletra 4110
HPE Compute Edge Server e930t
HPE ProLiant DL110 Gen11
HPE ProLiant DL360 Gen11 Server
HPE ProLiant DL320 Gen11 Server
HPE ProLiant DL380 Gen11 Server
HPE ProLiant DL380a Gen11
HPE ProLiant DL560 Gen11
HPE ProLiant ML110 Gen11
HPE ProLiant ML350 Gen11 Server
HPE ProLiant DL20 Gen10 Server
HPE ProLiant DL325 Gen10 Server
HPE ProLiant DL345 Gen10 Plus server
HPE ProLiant DL365 Gen10 Plus server
HPE ProLiant DL385 Gen10 Plus v2 server
HPE ProLiant DL325 Gen10 Plus v2 server
HPE ProLiant DL325 Gen10 Plus server
HPE ProLiant DL385 Gen10 Plus server
HPE ProLiant XL225n Gen10 Plus 1U Node
HPE ProLiant XL645d Gen10 Plus Server
HPE ProLiant XL675d Gen10 Plus Server
HPE ProLiant ML30 Gen10 Server
HPE ProLiant DL385 Gen10 Server
HPE ProLiant DL360 Gen10 Server
HPE ProLiant ML350 Gen10 Server
HPE ProLiant BL460c Gen10 Server Blade
HPE ProLiant ML110 Gen10 Server
HPE ProLiant e910t Server Blade
HPE Synergy 480 Gen10 Compute Module
HPE Synergy 660 Gen10 Compute Module
HPE ProLiant DL560 Gen10 Server
HPE ProLiant e910 Server Blade
HPE ProLiant XL190r Gen10 Server
HPE ProLiant XL170r Gen10 Server
HPE ProLiant DL160 Gen10 Server
HPE ProLiant DL180 Gen10 Server
HPE ProLiant DL380 Gen10 Server
Superdome Flex Server
PowerScale OneFS
Oracle Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
openSUSE Leap
openEuler
Red Hat OpenShift Container Platform
Precision 7960 Rack
HPE Synergy 480 Gen10 Plus Compute Module
Avamar Data Store Gen5A
RecoverPoint Classic
Disk Library for mainframe (DLm)
PowerEdge T30 Mini Tower Server
PowerEdge R6415
PowerEdge R7415
PowerEdge R7425
PowerEdge XE8545
PowerEdge R6525
PowerEdge R7525
PowerEdge C6525
PowerEdge R6515
PowerEdge R7515
ovmf
ovmf-tools
qemu-ovmf-x86_64
qemu-uefi-aarch64
edk2
edk2-debugsource
edk2-debuginfo
edk2-devel
python3-edk2-devel
edk2-help
edk2-aarch64
edk2-ovmf
qemu-ovmf-x86_64-debug
qemu-ovmf-ia32
qemu-uefi-aarch32
edk2 (Red Hat package)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in MdeModulePkg/Core/PiSmmCore/PiSmmCore.c. A local user trigger an out-of-bounds write and execute arbitrary code with elevated privileges.

Install updates from vendor's website.

• https://bugzilla.tianocore.org/show_bug.cgi?id=3387
• https://github.com/tianocore/edk2/commit/cab1f02565d3b29081dd21afb074f35fdb4e1fd6