CVE-2019-14576
Description
[REJECTED CVE] The PE32/PE32+/TE image formats contain an EFI_IMAGE_DATA_DIRECTORY[] array that can contain an EFI_IMAGE_DIRECTORY_ENTRY_SECURITY element. This element in the array, and the content it describes are not included in the signature verification. The content describes one or more WIN_CERTIFICATES that are used in signature verification.
For obvious reasons the content itself cannot be part of the signature check (else by calculating it, it would change the signature itself). However, the DataDirectory entry itself, could be part of the signature check. It is currently not the case.
Because it's not, it gives an attacker a lot of leaway to take an existing validly signed .efi, make the room for the EFI_IMAGE_DIRECTORY_ENTRY_SECURITY content larger, and start adding content to it, while still leaving the WIN_CERTIFICATE in tact enough to pass signature verification. This would allow an attacker to get arbitrary content inside of the the EFI_IMAGE_DIRECTORY_ENTRY_SECURITY content mapped into memory, presumably with RWX or RX page protections. Hence having shellcode ready to go, in case an exploit is found somewhere (bypassing exploit mitigations).
Statement
This CVE has been rejected as it does not consider this to be a security vulnerability, given that to exploit this you need another existing vulnerability. This is more of a second security layer/hardening feature.
Red Hat has evaluated this issue and determined that it does not meet the criteria to be classified as a security vulnerability. This assessment is based on the issue not posing a significant security risk, being a result of misconfiguration or usage error, or falling outside the scope of security considerations.
As such, this CVE has been marked as "Rejected" in alignment with Red Hat's vulnerability management policies.
If you have additional information or concerns regarding this determination, please contact Red Hat Product Security for further clarification.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 0 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
