9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2689-5p89-6j3j

GHSA-2689-5p89-6j3j: UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable

uefi-firmware contains a stack out-of-bounds write vulnerability in the native tiano/EFI decompressor. in uefi_firmware/compression/Tiano/Decompress.c, MakeTable() does not validate that bit-length values read from the compressed bitstream are within the expected range (0..16). a crafted firmware blob can supply bit lengths greater than 16, causing out-of-bounds writes to the stack-allocated Count[17] array and related decode tables.

reachability is through the normal parsing path: CompressedSection.process() -> efi_compressor.TianoDecompress() -> TianoDecompress() -> ReadPTLen() -> MakeTable().

Minimum impact is a deterministic crash; depending on build/runtime details, the stack memory corruption may be exploitable for code execution in the context of the parsing process. this project shipped its own copy of the decompressor without the upstream EDK2 hardening for this bug class.

References:

PR: https://github.com/theopolis/uefi-firmware-parser/pull/145
fix commit: https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e
upstream related fixes: CVE-2017-5731, CVE-2017-5732, CVE-2017-5733, CVE-2017-5734, CVE-2017-5735

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2689-5p89-6j3j

GHSA-2689-5p89-6j3j:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
uefi-firmware	pip	<= 1.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stack-based buffer overflow in the MakeTable function within the Tiano decompression logic in uefi_firmware/compression/Tiano/Decompress.c. The MakeTable function populates a histogram Count of size 17 with code lengths read from the compressed data. The vulnerability exists because there is no validation to ensure the code length values (BitLen[Index]) are within the valid range of 0 to 16 before using them as an index into the Count array. An attacker can craft a malicious firmware image with code lengths greater than 16. When MakeTable processes this, it writes past the end of the Count array on the stack, leading to memory corruption. This can cause a crash or, potentially, arbitrary code execution.

The patch introduces a check if (BitLen[Index] > 16) inside the loop in MakeTable to prevent this out-of-bounds write.

The vulnerable functions identified are:

MakeTable: The function containing the direct out-of-bounds write.
ReadPTLen and ReadCLen: These functions read the malicious data and pass it to MakeTable.
TianoDecompress: The top-level API function that triggers the vulnerable decompression path. These functions would appear in a runtime profile or stack trace during exploitation.

Vulnerable functions

MakeTable

uefi_firmware/compression/Tiano/Decompress.c

The MakeTable function is vulnerable to a stack-based buffer overflow. It uses a 'Count' array of size 17, indexed by values from the 'BitLen' array. The code does not validate that the values in 'BitLen' are within the bounds of the 'Count' array (0-16). A crafted input can provide a 'BitLen' value greater than 16, leading to an out-of-bounds write on the stack.

ReadPTLen

uefi_firmware/compression/Tiano/Decompress.c

This function reads code lengths from the compressed input and calls the vulnerable MakeTable function. It is a necessary step in the execution path to trigger the vulnerability.

ReadCLen

uefi_firmware/compression/Tiano/Decompress.c

Similar to ReadPTLen, this function reads code lengths for the Char&Len set and calls the vulnerable MakeTable function, providing another path to trigger the out-of-bounds write.

TianoDecompress

uefi_firmware/compression/Tiano/Decompress.c

This is the main entry point for the Tiano decompression algorithm. It initiates the decompression process which eventually calls the vulnerable MakeTable function. An exploit would likely involve calling this function with malicious data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.