Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
The PE/COFF relocation apply loop in PeCoffLoaderRelocateImage resolves each fixup target via PeCoffLoaderImageAddress, which validates only that the base byte offset satisfies Address < ImageSize + TeStrippedOffset.
PxeBcParseVendorOptions walks the PXE sub-options inside DHCP option 43 using a UINT8 Offset (line 93).
PxeBcParseVendorOptions iterates over PXE sub-options within DHCP option 43 using an outer loop guarded by Offset < VendorOptionLen.
HttpBootParseDhcp6Packet calls AsciiStrLen((CHAR8 *)Options[HTTP_BOOT_DHCP6_IDX_BOOT_FILE_URL]->Data) at line 273 on the raw DHCPv6 OFFER/REPLY boot-file-URL option bytes.
Both Dhcp6SeekOption and Dhcp6SeekIaOption iterate over DHCP6 options using a loop guarded only by Cursor < Buf + SeekLen.
The device-controlled LBA Data Size (Lbads) field — a full UINT8 (0–255) from the NVMe Identify Namespace response — is used directly as the shift amount in (UINT32)1 << Lbads without any bounds validation.
In the HTTP CONNECT (proxy) branch of EfiHttpRequest, EndPointUrlMsg is allocated at line 700 and freed at line 716 without being set to NULL.
In UsbBusBuildProtocol (whose debug messages are prefixed UsbBusStart), RootHub is allocated at line 1037 (AllocateZeroPool(sizeof(USB_DEVICE))).
In the multi-vCPU boot-time memory-acceptance path, BspApAcceptMemoryResourceRange calls TdAcceptPages (which performs TDCALL(TDACCEPTPAGE)) and stores the result in Status.
XenStoreProcessMessage reads an xsd_sockmsg header (containing a 32-bit Header.len field) from the XenStore shared-memory ring, which is populated by the Xen host/dom0 toolstack.
ParseDnsResponse processes attacker-controlled DNS answer records in a loop bounded by DnsHeader->AnswersNum from the wire.
When an HTTP server responds with 401 Unauthorized and a WWW-Authenticate header, HttpBootGetBootFile allocates Private->AuthScheme via AllocateZeroPool (line 1486).
A copy-paste error at lines 199 and 201 of HestParser.c causes incorrect argument handling in variadic Print() calls.
In XhcInitSched, three allocations use ASSERT-only guards before dereference.
The 64-bit counterpart of XhcInitializeDeviceSlot.
In XhcInitializeEndpointContext, two EndpointTransferRing allocations have NO NULL CHECK AT ALL (not even ASSERT) before the result is stored and passed to CreateTransferRing which dereferences it.
The 64-byte-context counterpart of XhcInitializeEndpointContext, used when the controller reports Csz != 0 (Xhci.c:1110-1113).
An additional unchecked allocation within XhcInitializeDeviceSlot, next to the unchecked InputContext (line 2246) and EndpointTransferRing (line 2307) allocations in the same function.
In the GET_DESCRIPTOR hook of the XHCI DXE control transfer handler XhcControlTransfer (Xhci.c:1035-1075), three AllocateZeroPool calls have NO NULL CHECK before dereference.
The PEI-phase counterpart of CreateTransferRing.
The PEI-phase counterpart of CreateEventRing.
The PEI-phase counterpart of XhcInitSched.
The PEI-phase counterpart of XhcInitializeDeviceSlot.
The PEI-phase 64-bit counterpart of XhcInitializeDeviceSlot.
The PEI-phase counterpart of XhcInitializeEndpointContext.
// No embargoed advisories on this page.