Ubuntu 20.04 LTS USN-4684-1: Critical EDK II Denial Of Service Attack

ubuntu

January 7, 2021

Several security issues were fixed in EDK II.

Summary

Several security issues were fixed in EDK II.

Software Description:

- edk2: UEFI firmware for virtual machines

Details:

Laszlo Ersek discovered that EDK II incorrectly validated certain signed

images. An attacker could possibly use this issue with a specially crafted

image to cause EDK II to hang, resulting in a denial of service. This issue

only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.

(CVE-2019-14562)

It was discovered that EDK II incorrectly parsed signed PKCS #7 data. An

attacker could use this issue to cause EDK II to crash, resulting in a

denial of service, or possibly execute arbitrary code. (CVE-2019-14584)

Topics Covered

security advisory denial of service critical ubuntu firmware update edk2 Ubuntu 20.04 LTS EDK II

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  ovmf                            2020.05-5ubuntu0.1
  qemu-efi                        2020.05-5ubuntu0.1
  qemu-efi-aarch64                2020.05-5ubuntu0.1
  qemu-efi-arm                    2020.05-5ubuntu0.1

Ubuntu 20.04 LTS:
  ovmf                            0~20191122.bd85bf54-2ubuntu3.1
  qemu-efi                        0~20191122.bd85bf54-2ubuntu3.1
  qemu-efi-aarch64                0~20191122.bd85bf54-2ubuntu3.1
  qemu-efi-arm                    0~20191122.bd85bf54-2ubuntu3.1

Ubuntu 18.04 LTS:
  ovmf                            0~20180205.c0d9813c-2ubuntu0.3
  qemu-efi                        0~20180205.c0d9813c-2ubuntu0.3
  qemu-efi-aarch64                0~20180205.c0d9813c-2ubuntu0.3
  qemu-efi-arm                    0~20180205.c0d9813c-2ubuntu0.3

Ubuntu 16.04 LTS:
  ovmf                            0~20160408.ffea0a2c-2ubuntu0.2
  qemu-efi                        0~20160408.ffea0a2c-2ubuntu0.2

After a standard system update you need to restart the virtual machines
that use the affected firmware to make all the necessary changes.