CVE-2018-3613 — Improper Authentication in Firmware Interface Development KIT

CWE-287 — Improper Authentication9 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 73.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Tianocore Edk2Extensible Firmware Interface Development KITTianocore EDK II
Timeline
PublishedMar 27
Latest updateJul 29

Description

Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶Ubuntutianocore/edk2< 0~20160408.ffea0a2c-2ubuntu0.2+esm1+1
▶NVDtianocore/edk_iiudk2015, udk2017, udk2018+2

Patches

Patch: edk2-docs.gitbooks.io ↗Patch: edk2-docs.gitbooks.io ↗

🔴Vulnerability Details

3
GHSA
GHSA-mv23-75j8-f4p8: Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privileg↗2022-05-13
▶
OSV
CVE-2018-3613: Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privileg↗2019-03-27
▶
CVEList
CVE-2018-3613: Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privileg↗2019-03-27
▶

📋Vendor Advisories

2
Ubuntu
EDK II vulnerabilities↗2024-07-29
▶
Red Hat
edk2: Logic error in MdeModulePkg in EDK II firmware allows for privilege escalation by authenticated users↗2018-10-16
▶

💬Community

3
Bugzilla
CVE-2018-3613 edk2: Logic error in MdeModulePkg in EDK II firmware allows for privilege escalation by authenticated users [epel-all]↗2018-10-22
▶
Bugzilla
CVE-2018-3613 edk2: Logic error in MdeModulePkg in EDK II firmware allows for privilege escalation by authenticated users↗2018-10-22
▶
Bugzilla
CVE-2018-3613 edk2: Logic error in MdeModulePkg in EDK II firmware allows for privilege escalation by authenticated users [fedora-all]↗2018-10-22
▶
CVE-2018-3613 — Improper Authentication | cvebase