CVE-2018-3630 — ovmf: Logic error in FV parsing in MdeModulePkg\Core\Pei\FwVol\FwVol.c

Back Back to CVE browser

HIGH

ovmf: Logic error in FV parsing in MdeModulePkg\Core\Pei\FwVol\FwVol.c

Published Oct 28, 2019

7.6

HIGH

CVSS 3.0

EPSS 0.24%

Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none

Affected products

Red Hat Enterprise Linux 7

ovmf

Not affected
Red Hat Enterprise Linux 8

edk2

Not affected
Red Hat Virtualization 4

redhat-virtualization-host

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	ovmf	Not affected	n/a
Red Hat Enterprise Linux 8	edk2	Not affected	n/a
Red Hat Virtualization 4	redhat-virtualization-host	Not affected	n/a

Remediation

Red Hat statement

Please note that, this CVE has been rejected upstream.

Metrics

0.24% 0.00241

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Dec 12, 2024.

EPSS probability 0.00241

Score over time

Feb–Dec 2024

EPSS v3

Percentile over time

EPSS v3

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Dec 12, 2024	0.24% (0.00241)	64.66th	v3 (v2023.03.01)
Feb 8, 2024	0.24% (0.00241)	63.21th	v3 (v2023.03.01)

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (4)

https://access.redhat.com/security/cve/CVE-2018-3630
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1683653
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2018-3630
https://www.cve.org/CVERecord?id=CVE-2018-3630

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-3630		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1683653		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2018-3630
https://www.cve.org/CVERecord?id=CVE-2018-3630