Bug 1960321 (CVE-2021-38578)

Summary: CVE-2021-38578 edk2: integer underflow in SmmEntryPoint function leads to potential SMM privilege escalation
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: berrange, crobinso, ddepaula, f4bug, jferlan, jmaloy, kraxel, lersek, pbonzini, security-response-team, virt-maint, virt-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in edk2. A integer underflow in the SmmEntryPoint function leads to a write into the SMM region allowing a local attacker with administration privileges on the system to execute code within the SMM privileged context. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1989857, 2096378, 2096379, 1989856    
Bug Blocks: 1959708    

Description Guilherme de Almeida Suckevicz 2021-05-13 16:32:19 UTC
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.

Reference:
https://bugzilla.tianocore.org/show_bug.cgi?id=3387

Comment 5 Mauro Matteo Cascella 2022-06-13 16:39:29 UTC
Created edk2 tracking bugs for this issue:

Affects: epel-7 [bug 2096378]
Affects: fedora-all [bug 2096379]

Comment 6 Gerd Hoffmann 2022-06-14 11:59:28 UTC
https://edk2.groups.io/g/devel/message/90516