Use After Free Vulnerability in EDK II by TianoCore
CVE-2019-14586

8HIGH

Key Information:

Vendor

Tianocore

Status
Extensible Firmware Interface Development Kit (edk Ii)
Vendor
CVE Published:
23 November 2020

What is CVE-2019-14586?

The EDK II component within the TianoCore firmware framework is susceptible to a use after free vulnerability. This flaw can be exploited by an authenticated user to gain elevated privileges, disclose sensitive information, or initiate a denial of service attack through adjacent access. Proper understanding and mitigation of this vulnerability are crucial for maintaining system integrity and security.

Affected Version(s)

Extensible Firmware Interface Development Kit (EDK II) EDK II

References

https://bugzilla.tianocore.org/show_bug.cgi?id=1995
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021/04/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.