Homepage
About Snyk

Access of Resource Using Incompatible Type ('Type Confusion') Affecting edk2-ovmf package, versions <0:20221207gitfff6d81270b5-9.el9_2

Severity

 Recommended
0.0
high
0
10

Based on AlmaLinux security rating

    Threat Intelligence

    EPSS
    0.39% (74th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-ALMALINUX9-EDK2OVMF-5659311
  • published 28 May 2023
  • disclosed 28 Feb 2023
Report a new vulnerability Found a mistake?

Introduced: 28 Feb 2023

CVE-2023-0286 Open this link in a new tab
CWE-843 Open this link in a new tab

How to fix?

Upgrade AlmaLinux:9 edk2-ovmf to version 0:20221207gitfff6d81270b5-9.el9_2 or higher.
This issue was patched in ALSA-2023:2165.

NVD Description

Note: Versions mentioned in the description apply only to the upstream edk2-ovmf package and not the edk2-ovmf package as distributed by AlmaLinux. See How to fix? for AlmaLinux:9 relevant fixed versions and status.

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

References

CVSS Scores

version 3.1
Expand this section

NVD

7.4 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    None
  • Availability (A)
    High
Expand this section

SUSE

7.4 high
Expand this section

Red Hat

7.4 high