Name: CVE-2021-38578: Buffer Underwrite
Published: 2022-03-03T00:00:00.000Z
Keywords: CVE, CVE-2021-38578, CWE-124, CWE-787, CVSS 7.4, EPSS 0.00995

Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.

CVSS Details

CVSS 3.1 Base Score: 7.4
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	View advisory ↗View advisory ↗	alma-upgrade-edk2-aarch64alma-upgrade-edk2-ovmfalma-upgrade-edk2-toolsalma-upgrade-edk2-tools-doc	May 15, 2023	Mar 3, 2022
Amazon Linux Ami 2	View advisory ↗	amazon-linux-ami-2-upgrade-edk2-aarch64amazon-linux-ami-2-upgrade-edk2-debuginfoamazon-linux-ami-2-upgrade-edk2-ovmfamazon-linux-ami-2-upgrade-edk2-toolsamazon-linux-ami-2-upgrade-edk2-tools-doc	Dec 20, 2024	Mar 3, 2022
Centos_linux	—	centos-upgrade-edk2-ovmf	May 15, 2023	Mar 3, 2022
Debian	View advisory ↗	debian-upgrade-edk2	Jul 30, 2024	Mar 3, 2022
Dell Poweredge Dsa2023097	View advisory ↗View advisory ↗	dell-poweredge-upgrade-latest	Jan 12, 2026	May 23, 2023
Oracle_linux	—	oracle-linux-upgrade-edk2-aarch64oracle-linux-upgrade-edk2-ovmforacle-linux-upgrade-edk2-toolsoracle-linux-upgrade-edk2-tools-doc	May 18, 2023	Mar 3, 2022
Redhat_linux	View advisory ↗	redhat-upgrade-edk2-aarch64redhat-upgrade-edk2-debugsourceredhat-upgrade-edk2-ovmfredhat-upgrade-edk2-toolsredhat-upgrade-edk2-tools-debuginforedhat-upgrade-edk2-tools-doc	May 15, 2023	Mar 3, 2022
Suse	—	suse-upgrade-ovmfsuse-upgrade-ovmf-toolssuse-upgrade-qemu-ovmf-ia32suse-upgrade-qemu-ovmf-x86_64suse-upgrade-qemu-ovmf-x86_64-debugsuse-upgrade-qemu-uefi-aarch32suse-upgrade-qemu-uefi-aarch64	Aug 9, 2024	Mar 3, 2022
Ubuntu	View advisory ↗	ubuntu-pro-upgrade-ovmfubuntu-pro-upgrade-qemu-efiubuntu-pro-upgrade-qemu-efi-aarch64ubuntu-pro-upgrade-qemu-efi-armubuntu-upgrade-ovmfubuntu-upgrade-ovmf-ia32ubuntu-upgrade-qemu-efi-aarch64ubuntu-upgrade-qemu-efi-arm	Oct 11, 2024	Mar 3, 2022

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub