40. AuthVariable Timestamp Zeroing on APPEND_WRITE

Description:
Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
Impact:
Escalation of Privilege, Information Disclosure and/or Denial of Service
Severity:
Medium 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Recommendation:
EDK II commits:
[master] https://github.com/tianocore/edk2/commit/b7dc8888f31402f410c53242839271ba3b94b619​
[UDK2018] https://github.com/tianocore/edk2/commits/348d9f7a078cf8893a803bc4e90abefb3126344a​
[UDK2017] https://github.com/tianocore/edk2/commits/5c693e581e6ab2c8e9daac170616d867272399d9​
[UDK2015] https://github.com/tianocore/edk2/commits/2bfddc064b1cd1f4539350bff1473a9c371865d8​
Acknowledgments:
Intel Team
References:
CVE-2018-3613
EDK II Bugzilla #415​

39. Unlimited FV Recursion

41. BootGuard TOCTOU

Last modified 2yr ago