CVE-2014-8271 : Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain

Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name.

Published 2020-02-06 15:15:11

Updated 2020-02-11 15:33:07

Source CERT/CC

View at NVD, CVE.org

Vulnerability category: Overflow

Exploit prediction scoring system (EPSS) score for CVE-2014-8271

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-8271

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.8	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	0.9	5.9	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2014-8271

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-8271

http://sourceforge.net/p/edk2/code/16280/

EDK II / Code / Commit [r16280]
Patch
http://www.kb.cert.org/vuls/id/533140

VU#533140 - Tianocore UEFI implementation reclaim function vulnerable to buffer overflow
Third Party Advisory;US Government Resource

Products affected by CVE-2014-8271

Tianocore » Edk2
Versions before (<) svn_16280
cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2014-8271

Exploit prediction scoring system (EPSS) score for CVE-2014-8271

CVSS scores for CVE-2014-8271

CWE ids for CVE-2014-8271

References for CVE-2014-8271

Products affected by CVE-2014-8271