Integer Overflow Vulnerability in UEFI Implementation by EDK2

CVE-2014-4860

What is CVE-2014-4860?

Multiple integer overflow issues during the Pre-EFI Initialization (PEI) boot phase in EDK2's Capsule Update feature could allow an attacker with physical access to exploit these flaws. By sending specially crafted data during the coalescing phase, an attacker might bypass the intended access restrictions, compromising the integrity of the system.

References