CVE-2021-28210 — Uncontrolled Recursion

Vendor	Product	Version range	Fixed in
debian	edk2	< edk2 2020.11-1 (bookworm)	edk2 2020.11-1 (bookworm)
msrc	cbl2_qemu_6.2.0-24_on_cbl_mariner_2.0	—	—
tianocore	edk2	>= 0 < 0~20191122.bd85bf54-2ubuntu3.6	0~20191122.bd85bf54-2ubuntu3.6
tianocore	edk2	>= 0 < 0~20191122.bd85bf54-2ubuntu3.2	0~20191122.bd85bf54-2ubuntu3.2
tianocore	edk2	>= 0 < 2022.02-3ubuntu0.22.04.3	2022.02-3ubuntu0.22.04.3
tianocore	edk2	>= 0 < 0~20160408.ffea0a2c-2ubuntu0.2+esm3	0~20160408.ffea0a2c-2ubuntu0.2+esm3
tianocore	edk2	>= 0 < 0~20180205.c0d9813c-2ubuntu0.3+esm2	0~20180205.c0d9813c-2ubuntu0.3+esm2

Ubuntu

EDK II vulnerabilities

vendor_ubuntu·2024-10-10·CVSS 5.5

CVE-2021-38578 [MEDIUM] EDK II vulnerabilities Title: EDK II vulnerabilities Summary: Several security issues were fixed in EDK II. It was discovered that EDK II did not check the buffer length in XHCI, which could lead to a stack overflow. A local attacker could potentially use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-0161) Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28210) Satoshi Tanda discovered that EDK II incorrectly handled decompressing certain images. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of

Microsoft

An unlimited recursion in DxeCore in EDK II.

vendor_msrc·2021-06-08·CVSS 7.8

CVE-2021-28210 [HIGH] CWE-674 An unlimited recursion in DxeCore in EDK II. An unlimited recursion in DxeCore in EDK II. FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner TianoCore: TianoCore Customer Action Required: Yes

Ubuntu

EDK II vulnerabilities

vendor_ubuntu·2021-04-20·CVSS 7.8

CVE-2021-28211 [HIGH] EDK II vulnerabilities Title: EDK II vulnerabilities Summary: Several security issues were fixed in EDK II. Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. (CVE-2021-28210) Satoshi Tanda discovered that EDK II incorrectly handled decompressing certain images. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-28211) Instructions: After a standard system update you need to restart the virtual machines that use the affected firmware to make all the necessary changes.

Debian

CVE-2021-28210: edk2 - An unlimited recursion in DxeCore in EDK II.

vendor_debian·2021·CVSS 7.8

CVE-2021-28210 [HIGH] CVE-2021-28210: edk2 - An unlimited recursion in DxeCore in EDK II. An unlimited recursion in DxeCore in EDK II. Scope: local bookworm: resolved (fixed in 2020.11-1) bullseye: resolved (fixed in 2020.11-1) forky: resolved (fixed in 2020.11-1) sid: resolved (fixed in 2020.11-1) trixie: resolved (fixed in 2020.11-1)

Red Hat

edk2: unlimited FV recursion, round 2

vendor_redhat·2020-11-19·CVSS 7.8

CVE-2021-28210 [HIGH] CWE-674 edk2: unlimited FV recursion, round 2 edk2: unlimited FV recursion, round 2 An unlimited recursion in DxeCore in EDK II. A flaw was found in edk2. An unlimited recursion in DxeCore may allow an attacker to corrupt the system memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Package: ovmf (Red Hat Enterprise Linux 7) - Out of support scope Package: edk2 (Red Hat Enterprise Linux 9) - Not affected

OSV

edk2 vulnerabilities

osv·2024-10-10·CVSS 5.5

CVE-2019-0161 [MEDIUM] edk2 vulnerabilities edk2 vulnerabilities It was discovered that EDK II did not check the buffer length in XHCI, which could lead to a stack overflow. A local attacker could potentially use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-0161) Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28210) Satoshi Tanda discovered that EDK II incorrectly handled decompressing certain images. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only aff

OSV

edk2 vulnerabilities

osv·2021-04-20·CVSS 7.8

CVE-2021-28210 [HIGH] edk2 vulnerabilities edk2 vulnerabilities Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. (CVE-2021-28210) Satoshi Tanda discovered that EDK II incorrectly handled decompressing certain images. A remote attacker could use this issue to cause EDK II to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-28211)

CVE-2021-28210: An unlimited recursion in DxeCore in EDK II. FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially…

Affected

CVSS provenance