CVE-2019-14563 - edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib

HIGH

edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib

Published Nov 23, 2020

7.8

HIGH

CVSS 3.1

EPSS 0.40%

Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Extensible Firmware Interface Development Kit (EDK II)

n/a

Version	Status	Constraints
EDK II	affected	-

Red Hat Enterprise Linux 8

edk2-0:20190829git37eef91017ad-9.el8

Fixed · RHSA-2020:1712
Red Hat Enterprise Linux 7

ovmf

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	edk2-0:20190829git37eef91017ad-9.el8	Fixed	RHSA-2020:1712
Red Hat Enterprise Linux 7	ovmf	Will not fix	n/a

No remediation recorded yet.

Weaknesses (3)

CWE-190

Integer Overflow

CWE-681

CWE-787

Out-of-bounds Write

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-14563		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1758620		Issue Tracking
https://bugzilla.tianocore.org/show_bug.cgi?id=2001		x_refsource_MISCIssue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-5724		Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14563
https://www.cve.org/CVERecord?id=CVE-2019-14563