Description<!---->A heap-based buffer overflow flaw was found via the Tcg2MeasurePeImage() function in EDK2. Successful exploitation requires a local malicious user to trigger an integer overflow in the calculation of the EventSize variable at DxeTpm2MeasureBootLib.c, leading to the heap-buffer overflow, presenting a moderate risk to confidentiality and integrity. However, the primary consequence is likely a crash or denial of service.A heap-based buffer overflow flaw was found via the Tcg2MeasurePeImage() function in EDK2. Successful exploitation requires a local malicious user to trigger an integer overflow in the calculation of the EventSize variable at DxeTpm2MeasureBootLib.c, leading to the heap-buffer overflow, presenting a moderate risk to confidentiality and integrity. However, the primary consequence is likely a crash or denial of service.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
tianocore edk2 |
Vulmon