Vulnerability-Lookup

CVE-2021-38577 (GCVE-0-2021-38577)

Vulnerability from cvelistv5 – Published: – Updated: 2022-11-30 00:00

DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2022-11-30T00:00:00.000Z",
        "orgId": "65518388-201a-4f93-8712-366d21fe8d2c",
        "shortName": "TianoCore"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c",
    "assignerShortName": "TianoCore",
    "cveId": "CVE-2021-38577",
    "dateRejected": "2022-11-30T00:00:00.000Z",
    "dateReserved": "2021-08-11T00:00:00.000Z",
    "dateUpdated": "2022-11-30T00:00:00.000Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.\"}]",
      "id": "CVE-2021-38577",
      "lastModified": "2023-11-07T03:37:26.887",
      "published": "2022-03-03T22:15:08.373",
      "sourceIdentifier": "infosec@edk2.groups.io",
      "vulnStatus": "Rejected"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-38577\",\"sourceIdentifier\":\"infosec@edk2.groups.io\",\"published\":\"2022-03-03T22:15:08.373\",\"lastModified\":\"2023-11-07T03:37:26.887\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.\"}],\"metrics\":{},\"references\":[]}}"
  }
}

GSD-2021-38577

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

Aliases

CVE-2021-38577

Aliases

CVE-2021-38577

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-38577",
    "description": "Heap Overflow in BaseBmpSupportLib.",
    "id": "GSD-2021-38577",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-38577.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-38577"
      ],
      "details": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.",
      "id": "GSD-2021-38577",
      "modified": "2023-12-13T01:23:17.722385Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2021-38577",
        "STATE": "REJECT"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage."
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "202105",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "infosec@edk2.groups.io",
          "ID": "CVE-2021-38577"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Heap Overflow in BaseBmpSupportLib."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-787"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=3360",
              "refsource": "MISC",
              "tags": [
                "Issue Tracking",
                "Permissions Required",
                "Vendor Advisory"
              ],
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=3360"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-03-10T01:55Z",
      "publishedDate": "2022-03-03T22:15Z"
    }
  }
}

CNVD-2022-23459

Vulnerability from cnvd - Published: 2022-03-29

Title

Tianocore Edk2缓冲区溢出漏洞（CNVD-2022-23459）

Description

Tianocore Edk2是Tianocore社区的一个遵循UEFI和PI规范的跨平台固件开发环境。 Tianocore Edk2存在缓冲区溢出漏洞，该漏洞源于BaseBmpSupportLib中的堆溢出。目前没有详细漏洞细节提供。

Severity

高

Patch Name

Tianocore Edk2缓冲区溢出漏洞（CNVD-2022-23459）的补丁

Patch Description

Tianocore Edk2是Tianocore社区的一个遵循UEFI和PI规范的跨平台固件开发环境。 Tianocore Edk2存在缓冲区溢出漏洞，该漏洞源于BaseBmpSupportLib中的堆溢出。目前没有详细漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://bugzilla.tianocore.org/show_bug.cgi?id=3360

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-38577

Impacted products

Name
tianocore EDK2

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-38577"
    }
  },
  "description": "Tianocore Edk2\u662fTianocore\u793e\u533a\u7684\u4e00\u4e2a\u9075\u5faaUEFI\u548cPI\u89c4\u8303\u7684\u8de8\u5e73\u53f0\u56fa\u4ef6\u5f00\u53d1\u73af\u5883\u3002\n\nTianocore Edk2\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eBaseBmpSupportLib\u4e2d\u7684\u5806\u6ea2\u51fa\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://bugzilla.tianocore.org/show_bug.cgi?id=3360",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-23459",
  "openTime": "2022-03-29",
  "patchDescription": "Tianocore Edk2\u662fTianocore\u793e\u533a\u7684\u4e00\u4e2a\u9075\u5faaUEFI\u548cPI\u89c4\u8303\u7684\u8de8\u5e73\u53f0\u56fa\u4ef6\u5f00\u53d1\u73af\u5883\u3002\r\n\r\nTianocore Edk2\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eBaseBmpSupportLib\u4e2d\u7684\u5806\u6ea2\u51fa\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Tianocore Edk2\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2022-23459\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "tianocore EDK2"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-38577",
  "serverity": "\u9ad8",
  "submitTime": "2022-03-04",
  "title": "Tianocore Edk2\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2022-23459\uff09"
}

FKIE_CVE-2021-38577

Vulnerability from fkie_nvd - Published: 2022-03-03 22:15 - Updated: 2023-11-07 03:37

Severity ?

Summary

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage."
    }
  ],
  "id": "CVE-2021-38577",
  "lastModified": "2023-11-07T03:37:26.887",
  "metrics": {},
  "published": "2022-03-03T22:15:08.373",
  "references": [],
  "sourceIdentifier": "infosec@edk2.groups.io",
  "vulnStatus": "Rejected"
}

GHSA-6H2R-64Q9-4XHR

Vulnerability from github – Published: 2022-03-04 00:00 – Updated: 2022-03-17 00:03

Details

Heap Overflow in BaseBmpSupportLib.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-38577"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-03T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Heap Overflow in BaseBmpSupportLib.",
  "id": "GHSA-6h2r-64q9-4xhr",
  "modified": "2022-03-17T00:03:40Z",
  "published": "2022-03-04T00:00:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38577"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=3360"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2021-38577 (GCVE-0-2021-38577)

GSD-2021-38577

CNVD-2022-23459

FKIE_CVE-2021-38577

GHSA-6H2R-64Q9-4XHR

Tags

Sightings

Nomenclature