CVE-2021-38575 - OpenCVE

NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Insyde	Kernel
Tianocore	Edk2

Configuration 1 [-]

cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:insyde:kernel:5.0:::::::*
	cpe:2.3:o:insyde:kernel:5.1:::::::*
	cpe:2.3:o:insyde:kernel:5.2:::::::*
	cpe:2.3:o:insyde:kernel:5.3:::::::*
	cpe:2.3:o:insyde:kernel:5.4:::::::*
	cpe:2.3:o:insyde:kernel:5.5:::::::*

References

Link	Resource
https://bugzilla.tianocore.org/show_bug.cgi?id=3356	Exploit Issue Tracking Vendor Advisory
https://www.insyde.com/security-pledge/SA-2023025	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: TianoCore

Published: 2021-12-01T00:00:00

Updated: 2023-07-23T00:00:00

Reserved: 2021-08-11T00:00:00

Link: CVE-2021-38575

JSON object: View

NVD Information

Status : Modified

Published: 2021-12-01T18:15:07.760

Modified: 2023-11-07T03:37:26.800

Link: CVE-2021-38575

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*", "matchCriteriaId": "D81E5FE6-D7EC-49DA-BB6A-E58F9D7D3FBB", "versionEndIncluding": "202105", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "FFCC4619-B867-4E23-AF05-FF92B43628AF", "vulnerable": true}, {"criteria": "cpe:2.3:o:insyde:kernel:5.1:*:*:*:*:*:*:*", "matchCriteriaId": "FB40061A-BEDF-4D72-BF2D-D1B10EB80A60", "vulnerable": true}, {"criteria": "cpe:2.3:o:insyde:kernel:5.2:*:*:*:*:*:*:*", "matchCriteriaId": "9D6AFE61-A2A4-49DF-A8EE-B2F425DA7A08", "vulnerable": true}, {"criteria": "cpe:2.3:o:insyde:kernel:5.3:*:*:*:*:*:*:*", "matchCriteriaId": "D21132C0-F2CF-4134-A165-926155031913", "vulnerable": true}, {"criteria": "cpe:2.3:o:insyde:kernel:5.4:*:*:*:*:*:*:*", "matchCriteriaId": "6549F7F1-A438-4C84-9D66-C89C697E2A9B", "vulnerable": true}, {"criteria": "cpe:2.3:o:insyde:kernel:5.5:*:*:*:*:*:*:*", "matchCriteriaId": "DE339FA1-8572-4365-B420-530D62686C08", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "NetworkPkg/IScsiDxe has remotely exploitable buffer overflows."}, {"lang": "es", "value": "NetworkPkg/IScsiDxe presenta unos desbordamientos de b\u00fafer explotables de forma remota"}], "id": "CVE-2021-38575", "lastModified": "2023-11-07T03:37:26.800", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-12-01T18:15:07.760", "references": [{"source": "infosec@edk2.groups.io", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=3356"}, {"source": "infosec@edk2.groups.io", "tags": ["Third Party Advisory"], "url": "https://www.insyde.com/security-pledge/SA-2023025"}], "sourceIdentifier": "infosec@edk2.groups.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-124"}], "source": "infosec@edk2.groups.io", "type": "Secondary"}]}