CVE-2018-12178 — edk2: improper DNS packet size check

Back Back to CVE browser

CRITICAL

edk2: improper DNS packet size check

Published Mar 27, 2019

9.1

CRITICAL

CVSS 3.0

EPSS 2.27%

Description

Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network.

Affected products

Vendor Extensible Firmware Interface Development Kit (EDK II) Product Extensible Firmware Interface Development Kit (EDK II) Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Extensible Firmware Interface Development Kit (EDK II)

n/a

Version	Status	Constraints

Red Hat Enterprise Linux 7

OVMF

Not affected
Red Hat Enterprise Linux 8

edk2

Not affected
Red Hat Virtualization 4

redhat-virtualization-host

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	OVMF	Not affected	n/a
Red Hat Enterprise Linux 8	edk2	Not affected	n/a
Red Hat Virtualization 4	redhat-virtualization-host	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the versions of OVMF as shipped with Red Hat Enterprise Linux 7 as they were not compiled with HTTP_BOOT_ENABLE set, thus they do not contain the vulnerable code.

Metrics

2.27% 0.02271

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02271

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.27% (0.02271)	82.44th	v5 (v2026.06.15)
Jun 15, 2026	2.27% (0.02271)	80.72th	v5 (v2026.06.15)
Mar 17, 2025	0.31% (0.00312)	52.14th	v4 (v2025.03.14)
Dec 12, 2024	0.38% (0.00383)	73.90th	v3 (v2023.03.01)
Mar 20, 2024	0.38% (0.00383)	72.51th	v3 (v2023.03.01)
Feb 8, 2024	0.34% (0.00341)	70.65th	v3 (v2023.03.01)
Mar 7, 2023	0.34% (0.00341)	66.86th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Feb 4, 2022	1.02% (0.01018)	19.50th	v2 (v2022.01.01)
Feb 3, 2022	1.55% (0.01550)	33.66th	v5 (v2026.06.15)
Apr 14, 2021	1.55% (0.01550)	0.00th	v1

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-125

Out-of-bounds Read

References (9)

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00046.html
vendor-advisoryx_refsource_SUSE
https://access.redhat.com/security/cve/CVE-2018-12178
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1683326
Issue Tracking
https://edk2-docs.gitbooks.io/security-advisory/content/dns-pack-size-check.html
x_refsource_CONFIRMPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ABTDKZK2G5XP6JCO3HXMPOA2NRTIYDZ/
vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2018-12178
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03912en_us
x_refsource_CONFIRM
https://usn.ubuntu.com/4349-1/
vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2018-12178

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00046.html		vendor-advisoryx_refsource_SUSE
https://access.redhat.com/security/cve/CVE-2018-12178		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1683326		Issue Tracking
https://edk2-docs.gitbooks.io/security-advisory/content/dns-pack-size-check.html		x_refsource_CONFIRMPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ABTDKZK2G5XP6JCO3HXMPOA2NRTIYDZ/		vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2018-12178
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03912en_us		x_refsource_CONFIRM
https://usn.ubuntu.com/4349-1/		vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2018-12178