Bugzilla – Bug 1131360
VUL-0: CVE-2018-12179: ovmf,OVMF: edk2: improper configuration insystem firmware leads to privilege escalation
Last modified: 2019-04-11 04:45:41 UTC
rh#1694072 Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. Reference: https://edk2-docs.gitbooks.io/security-advisory/content/opal-blocksid-setting-disabled-after-s3.html References: https://bugzilla.redhat.com/show_bug.cgi?id=1694072 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-12179 http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-12179.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12179 https://edk2-docs.gitbooks.io/security-advisory/content/opal-blocksid-setting-disabled-after-s3.html
This vulnerability is about the driver of TCG Opal, a.k.a. Self-Encrypting Disk. AFAIK, qemu doesn't support SED, so we don't need the patch. Bruce, could you confirm that?
(In reply to Gary Ching-Pang Lin from comment #1) > This vulnerability is about the driver of TCG Opal, a.k.a. Self-Encrypting > Disk. AFAIK, qemu doesn't support SED, so we don't need the patch. > > Bruce, could you confirm that? Correct, qemu does not deal with SED at all.
Thanks, Bruce. Then we don't need the patch.
close