CVE-2017-5731
published 2019-10-28CVE-2017-5731: Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.
PriorityP434high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.40%
32.2th percentile
Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_mojave | — | — |
| tianocore | edk2 | < 2017-11-07 | 2017-11-07 |
| tianocore | edk2 | >= 0 < 0~20160408.ffea0a2c-2ubuntu0.2+esm1 | 0~20160408.ffea0a2c-2ubuntu0.2+esm1 |
| tianocore | edk2 | >= 0 < 0~20180205.c0d9813c-2ubuntu0.3+esm1 | 0~20180205.c0d9813c-2ubuntu0.3+esm1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
ghsa7.8HIGH
osv7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen
ghsa·2026-04-16·CVSS 7.8
[HIGH] CWE-787 UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen
UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen
`uefi-firmware` contains a heap out-of-bounds write vulnerability in the native tiano/EFI decompressor. in `uefi_firmware/compression/Tiano/Decompress.c`, `ReadCLen()` reads `Number = GetBits(Sd, CBIT)` with `CBIT = 9`, so `Number` can be as large as `511`, while the destination array `Sd->mCLen` has `NC = 510` elements. the loop writes while `Index mCLen[Index++] = 0`.
Reachability is through the normal parsing path: `CompressedSection.process()` -> `efi_compressor.TianoDecompress()` -> `TianoDecompress()` -> `DecodeC()` -> `ReadCLen()`.
Minimum impact is a deterministic crash; depending on build/runtime details, the heap memory corruption may be exploitable for code execution in the context of the parsi
GHSA
UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable
ghsa·2026-04-16·CVSS 7.8
[HIGH] CWE-787 UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable
UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable
`uefi-firmware` contains a stack out-of-bounds write vulnerability in the native tiano/EFI decompressor. in `uefi_firmware/compression/Tiano/Decompress.c`, `MakeTable()` does not validate that bit-length values read from the compressed bitstream are within the expected range (`0..16`). a crafted firmware blob can supply bit lengths greater than `16`, causing out-of-bounds writes to the stack-allocated `Count[17]` array and related decode tables.
reachability is through the normal parsing path: `CompressedSection.process()` -> `efi_compressor.TianoDecompress()` -> `TianoDecompress()` -> `ReadPTLen()` -> `MakeTable()`.
Minimum impact is a deterministic crash; depending on build/runtime details, the stack
OSV
edk2 vulnerabilities
osv·2024-07-29·CVSS 7.8
CVE-2017-5731 [HIGH] edk2 vulnerabilities
edk2 vulnerabilities
It was discovered that EDK II was not properly performing bounds checks
in Tianocompress, which could lead to a buffer overflow. An authenticated
user could use this issue to potentially escalate their privileges via
local access. (CVE-2017-5731)
It was discovered that EDK II had an insufficient memory write check in
the SMM service, which could lead to a page fault occurring. An
authenticated user could use this issue to potentially escalate their
privileges, disclose information and/or create a denial of service via
local access. (CVE-2018-12182)
It was discovered that EDK II incorrectly handled memory in DxeCore, which
could lead to a stack overflow. An unauthenticated user could this
issue to potentially escalate their privileges, disclose information
and/or cre
OSV
CVE-2017-5731: Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local ac
osv·2019-10-28·CVSS 7.8
CVE-2017-5731 [HIGH] CVE-2017-5731: Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local ac
Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Ubuntu
EDK II vulnerabilities
vendor_ubuntu·2024-07-29·CVSS 7.8
CVE-2018-3613 [HIGH] EDK II vulnerabilities
Title: EDK II vulnerabilities
Summary: Several security issues were fixed in EDK II.
It was discovered that EDK II was not properly performing bounds checks
in Tianocompress, which could lead to a buffer overflow. An authenticated
user could use this issue to potentially escalate their privileges via
local access. (CVE-2017-5731)
It was discovered that EDK II had an insufficient memory write check in
the SMM service, which could lead to a page fault occurring. An
authenticated user could use this issue to potentially escalate their
privileges, disclose information and/or create a denial of service via
local access. (CVE-2018-12182)
It was discovered that EDK II incorrectly handled memory in DxeCore, which
could lead to a stack overflow. An unauthenticated user could this
issue to poten
Red Hat
edk2: Privilege escalation via processing of malformed files in TianoCompress.c
vendor_redhat·2018-10-16·CVSS 7.8
CVE-2017-5731 [HIGH] CWE-287 edk2: Privilege escalation via processing of malformed files in TianoCompress.c
edk2: Privilege escalation via processing of malformed files in TianoCompress.c
Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Package: edk2 (Red Hat Enterprise Linux 8) - Not affected
Apple
CVE-2017-5731: macOS Mojave 10.14
vendor_apple·2018-09-24·CVSS 7.8
CVE-2017-5731 [HIGH] CVE-2017-5731: macOS Mojave 10.14
Apple Security Update: About the security content of macOS Mojave 10.14
Product: macOS Mojave
Version: 10.14
CVE: CVE-2017-5731
Component: Firmware
Impact: An attacker with physical access to a device may be able to elevate privileges
Description: A memory corruption issue was addressed with improved input validation.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c [fedora-all]
bugzilla·2018-10-22·CVSS 7.8
CVE-2017-5731 [HIGH] CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c [fedora-all]
CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affect
Bugzilla
CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c [epel-all]
bugzilla·2018-10-22·CVSS 7.8
CVE-2017-5731 [HIGH] CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c [epel-all]
CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mu
Bugzilla
CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c
bugzilla·2018-10-22·CVSS 7.8
CVE-2017-5731 [HIGH] CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c
CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c
In EDK II, a vulnerability exists in TianoCompress.c (BaseTools/Source/C/TianoCompress) from github/tianocore/edk2. An authenticated attacker could exploit this via a crafted file to escalate privileges.
External Reference:
https://edk2-docs.gitbooks.io/security-advisory/content/edk-ii-tianocompress-bounds-checking-issues.html
Upstream Bug:
https://bugzilla.tianocore.org/show_bug.cgi?id=686
Discussion:
Created edk2 tracking bugs for this issue:
Affects: epel-all [bug 1641444]
Affects: fedora-all [bug 1641443]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2019:2125 https://access.redhat.com/errata/RHSA-2019:2125
---
This bug is now
2019-10-28
Published