Summary
Ein lokaler Angreifer kann eine Schwachstelle in TianoCore EDK2 ausnutzen, um Informationen offenzulegen.
Product
TianoCore EDK2 ist die Referenzimplementierung von UEFI von Intel.
Vulnerabilities 1
-
Medium 5.8
Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege
EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability will lead to possible information disclosure or escalation of privile…
Revision history
-
#4
Neue Updates von Dell aufgenommen
-
#3
Neue Updates von Dell aufgenommen
-
#2
Neue Updates von Amazon aufgenommen
-
#1
Initiale Fassung
References
-
Tianocore GitHub vom 2025-12-09
https://github.com/tianocore/edk2/security/advisories/GHSA-q2c6-37h5-7cwf
-
Indyde Security Advisory vom 2025-12-09
https://www.insyde.com/security-pledge/sa-2024003/
-
Lenovo Security Advisory LEN-207909 vom 2025-12-10
https://support.lenovo.com/us/en/product_security/LEN-207909
-
Amazon Linux Security Advisory ALAS2-2025-3116 vom 2026-01-05
https://alas.aws.amazon.com/AL2/ALAS2-2025-3116.html
-
Dell Security Advisory DSA-2025-422: Security Update for Dell Client Platform for an INSYDE BIOS Vulnerability vom 2026-01-06
https://www.dell.com/support/kbdoc/de-de/000412345/dsa-2025-422-security-update-for-dell-client-platform-for-an-insyde-bios-vulnerability
-
Dell Security Advisory DSA-2026-040 vom 2026-03-17
https://www.dell.com/support/kbdoc/000440351