Affected: Extensible Firmware Interface Development Kit (EDK II)

Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.

Affected: Ubuntu:Pro:16.04:LTS: edk2, Ubuntu:Pro:18.04:LTS: edk2, Ubuntu:20.04:LTS: edk2, Ubuntu:22.04:LTS: edk2

It was discovered that EDK II did not check the buffer length in XHCI, which could lead to a stack overflow. A local attacker could potentially use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-0161)

Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28210)

Satoshi Tanda discovered that EDK II incorrectly handled decompressing certain images. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28211)

It was discovered that EDK II incorrectly decoded certain strings. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-38575)

It was discovered that EDK II had integer underflow vulnerability in SmmEntryPoint, which could result in a buffer overflow. An attacker could potentially use this issue to cause a denial of service. (CVE-2021-38578)

Elison Niven discovered that OpenSSL, vendored in EDK II, incorrectly handled the c_rehash script. A local attacker could possibly use this issue to…