PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2019-14560

CVE-2019-14560

edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler()

Loading…

Severity

Moderate

Red Hat Product Security

6.1

CVSS 3.1

Review impact separately from score.

Published · July 1, 2020

Updated · November 21, 2025

Description

[REJECTED CVE] A secure boot bypass vulnerability was found in EDK2 due to the lack of proper return value checks in the GetEfiGlobalVariable2() function. The API may fail if functions like AllocatePool() or gRT->GetVariable() fail. Without verifying the return value, an attacker could cause the API to fail, potentially bypassing secure boot. This issue occurs in functions like DxeImageVerificationHandler, where the return value is not checked.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 6.1
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L

CWE-252 · Unchecked Return Value