EDK II - NULL Pointer Dereference in UpdateVariableInfo

Executive Summary

In UpdateVariableInfo, a VARIABLE_INFO_ENTRY is allocated with AllocateZeroPool guarded only by ASSERT — a no-op in RELEASE. The next line dereferences it via CopyGuid(&(*VariableInfo)->VendorGuid, ...). This path only executes during boot (guarded by AtRuntime() check) when PcdVariableCollectStatistics is enabled. The constant-size allocation means failure requires boot-time memory exhaustion.

This advisory is one of a set reported to VulnCheck on 2026-06-25 for coordinated disclosure to the EDK II maintainers. After several follow-ups over the following months no response was received. 126 days after the initial report, ByteRay is publishing the findings in good faith so that affected integrators can assess and remediate them. All findings were identified against EDK II commit 70741a15d9a714323a5598eac47727e60507e22f (master, 2026-06-21).

Affected Products and Versions

• Vendor: TianoCore
• Product: EDK II (MdeModulePkg)
• Affected commit: 70741a15d9a714323a5598eac47727e60507e22f (master, 2026-06-21). The code is present on that commit and later revisions that have not changed it.
• Location: MdeModulePkg/Universal/Variable/RuntimeDxe/VariableParsing.c:757
• Function: UpdateVariableInfo
• Category: error_handling

Technical Details

Controllability: SYSTEM_CONTROLLED — confidence: high. Doubly gated by PcdVariableCollectStatistics (default OFF) and AtRuntime() check (boot-phase only).

Data Flow

At line 742, FeaturePcdGet(PcdVariableCollectStatistics) gates the entire path (default OFF in production). At line 747, AtRuntime() check excludes runtime execution. At line 757, *VariableInfo = AllocateZeroPool(sizeof(VARIABLE_INFO_ENTRY)) is a constant-size allocation returning NULL on failure. At line 758, ASSERT is a no-op in RELEASE. At line 760, CopyGuid(&(*VariableInfo)->VendorGuid, VendorGuid) dereferences NULL.

Affected Callers

• Variable service statistics path (boot-phase only, feature-gated)

Sanitization / Security Controls

• Feature gate (PcdVariableCollectStatistics, default OFF); runtime gate (boot-phase only); DEBUG-only ASSERT.

Reachability and Preconditions

Attacker position and trust level for this issue are stated in the Controllability line and Data Flow above, and the concrete trigger is in Reproduction below.

Exploitability: Low
Realism: Low

Reproduction

1. PcdVariableCollectStatistics enabled (non-default); boot-phase execution; RELEASE build; boot-time memory exhaustion.
2. Build with feature enabled.
3. During boot, trigger variable access under memory exhaustion.
4. AllocateZeroPool returns NULL.
5. CopyGuid dereferences NULL.

Impact

Denial of service — firmware crash during boot; extremely unlikely in production.

Remediation and Mitigation

As of commit 70741a15d9a714323a5598eac47727e60507e22f this issue is unfixed upstream and no CVE has been assigned. Check the allocation result for NULL before dereferencing it and fail the operation cleanly when allocation fails. The specific control that is absent or ineffective is identified in the Sanitization / Security Controls list under Technical Details.

Timeline

• 2026-06-25 - Reported to VulnCheck for coordinated disclosure to the TianoCore / EDK II security team.
• 2026-07 to 2026-10 - Several follow-ups sent; no response received.
• 2026-10-29 - Public disclosure in good faith, 126 days after the initial report.

Credits

Discovered and reported by Argus-Systems.

References

• EDK II source (TianoCore)
• Affected file at the referenced commit