Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-6hcp-x8fr-rwcv

Опубликовано: 03 апр. 2025
Источник: github
Github: Не прошло ревью
CVSS3: 4.7

Описание

In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: uefisecapp: fix efivars registration race

Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access.

Make sure that all resources have been set up before registering the efivars.

In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: uefisecapp: fix efivars registration race

Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access.

Make sure that all resources have been set up before registering the efivars.

EPSS

Процентиль: 1%
0.0001
Низкий

4.7 Medium

CVSS3

Дефекты

CWE-367
CWE-476

Связанные уязвимости

CVSS3: 4.7
ubuntu
7 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access. Make sure that all resources have been set up before registering the efivars.

CVSS3: 4.4
redhat
7 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access. Make sure that all resources have been set up before registering the efivars.

CVSS3: 4.7
nvd
7 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access. Make sure that all resources have been set up before registering the efivars.

CVSS3: 4.7
debian
7 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: f ...

CVSS3: 4.7
fstec
10 месяцев назад

Уязвимость модуля drivers/firmware/qcom/qcom_qseecom_uefisecapp.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 1%
0.0001
Низкий

4.7 Medium

CVSS3

Дефекты

CWE-367
CWE-476