Skip to content
Fencer Intel
high 7.4

CVE-2021-38578 json

Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.

published 4y ago modified 4mo ago also EUVD-2021-25020

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.

Patch / fix

  • edk2 Debian 14, Debian 13, Debian 12 2022.11-1

debian advisories DEBIAN-CVE-2021-38578

  • edk2 Ubuntu 20.04 LTS 0~20191122.bd85bf54-2ubuntu3.6
  • edk2 Ubuntu 22.04 LTS 2022.02-3ubuntu0.22.04.3
  • edk2 Ubuntu Pro 16.04 LTS 0~20160408.ffea0a2c-2ubuntu0.2+esm3
  • edk2 Ubuntu Pro 18.04 LTS 0~20180205.c0d9813c-2ubuntu0.3+esm2

ubuntu advisories UBUNTU-CVE-2021-38578

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • edk2 RHEL 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-ovmf RHEL 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-tools RHEL 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-aarch64 RHEL 9 20221207gitfff6d81270b5-9.el9_2

red hat advisories RHSA-2023:2165

  • ovmf SLE Module for Server Applications 15 SP4, SLE Micro 5.4, SLE Micro 5.3 +2 more 202202-150400.5.10.1
  • ovmf SLES 12 SP2-BCL 2015+git1462940744.321151f-19.26.1
  • ovmf SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +7 more 202008-150300.10.20.1
  • ovmf SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 2017+git1510945757.b2662641d5-3.41.2
  • ovmf SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 201911-150200.7.27.1
  • ovmf SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 2017+git1510945757.b2662641d5-150000.5.46.1

suse advisories SUSE-SU-2023:2234-1SUSE-SU-2023:1968-1SUSE-SU-2023:1958-1SUSE-SU-2023:1941-1SUSE-SU-2023:1940-1SUSE-SU-2023:1921-1

  • ovmf openSUSE Tumbleweed 202211-1.1

opensuse advisories openSUSE-SU-2024:12542-1

  • edk2-ovmf AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-tools AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-aarch64 AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2

almalinux advisories ALSA-2023:2165

Is CVE-2021-38578 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-38578 updated cvss 7.4

edk2: integer underflow in SmmEntryPoint function leads to potential SMM privilege escalation

  • Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 edk2, edk2-ovmf, edk2-aarch64
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 9) edk2 20221207gitfff6d81270b5-9.el9_2, edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2 Red Hat Enterprise Linux CRB (v. 9) edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-tools 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2
    fixed: vendor fix RHSA-2023:2165

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-257-04 updated cvss 8.2

Siemens RUGGEDCOM APE1808 Products

  • Siemens RUGGEDCOM APE1808 ADM (6GK6015-0AL20-0GL0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808 ADM CC (6GK6015-0AL20-0GL1) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808 CKP (6GK6015-0AL20-0GK0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808 CKP CC (6GK6015-0AL20-0GK1) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808 CLOUDCONNECT (6GK6015-0AL20-0GM0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808 CLOUDCONNECT CC (6GK6015-0AL20-0GM1) <BIOS_V1.0.212N
    +16 more products
    Siemens RUGGEDCOM APE1808 ELAN (6GK6015-0AL20-0GP0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808 ELAN CC (6GK6015-0AL20-0GP1) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808 SAM-L (6GK6015-0AL20-0GN0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808 SAM-L CC (6GK6015-0AL20-0GN1) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808CLA-P (6GK6015-0AL20-1AA0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808CLA-P CC (6GK6015-0AL20-1AA1) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808CLA-S1 (6GK6015-0AL20-1AB0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808CLA-S1 CC (6GK6015-0AL20-1AB1) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808CLA-S3 (6GK6015-0AL20-1AD0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808CLA-S3 CC (6GK6015-0AL20-1AD1) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808CLA-S5 (6GK6015-0AL20-1AF0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808CLA-S5 CC (6GK6015-0AL20-1AF1) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808LNX (6GK6015-0AL20-0GH0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808LNX CC (6GK6015-0AL20-0GH1) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808W10 (6GK6015-0AL20-0GJ0) <BIOS_V1.0.212N Siemens RUGGEDCOM APE1808W10 CC (6GK6015-0AL20-0GJ1) <BIOS_V1.0.212N
    affected: fixed in V1.0.212N support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • TianoCore EDK II

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.