Integer Truncation Vulnerability in EDK II by TianoCore
CVE-2019-14563

7.8HIGH

Key Information:

Vendor

Tianocore

Status
Extensible Firmware Interface Development Kit (edk Ii)
Vendor
CVE Published:
23 November 2020

What is CVE-2019-14563?

An integer truncation vulnerability exists in EDK II that can be exploited by authenticated users. This flaw may permit these users to escalate their privileges through local access, potentially allowing for unauthorized actions within the system. Affected users should apply relevant security updates to mitigate the risks associated with this vulnerability.

Affected Version(s)

Extensible Firmware Interface Development Kit (EDK II) EDK II

References

https://bugzilla.tianocore.org/show_bug.cgi?id=2001
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021/04/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.