Memory Handling Vulnerability in Tianocore EDK II Firmware
CVE-2021-28216

7.8HIGH

Key Information:

Vendor

Tianocore

Status
Edk Ii
Vendor
CVE Published:
5 August 2021

What is CVE-2021-28216?

A vulnerability exists in Tianocore EDK II firmware due to improper handling of the BootPerformanceTable pointer, which is read from an NVRAM variable during the Pre-EFI Initialization (PEI) phase. This mismanagement can lead to potential issues in firmware performance reporting, and it is advised to set the PcdFirmwarePerformanceDataTableS3Support configuration to FALSE to mitigate associated risks.

Affected Version(s)

EDK II EDK II Master

References

https://bugzilla.tianocore.org/show_bug.cgi?id=2957
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.