BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially     enable escalation of privilege, denial of service and/or information disclosure via physical access.
    (CVE-2019-11098)

  - BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting     PcdFirmwarePerformanceDataTableS3Support to FALSE. (CVE-2021-28216)

  - NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. (CVE-2021-38575)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting     PcdFirmwarePerformanceDataTableS3Support to FALSE. (CVE-2021-28216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
159878	EulerOS Virtualization 2.10.0 : edk2 (EulerOS-SA-2022-1416)	Nessus	Huawei Local Security Checks	high
159875	EulerOS Virtualization 2.10.1 : edk2 (EulerOS-SA-2022-1390)	Nessus	Huawei Local Security Checks	high
155504	EulerOS Virtualization 2.9.1 : edk2 (EulerOS-SA-2021-2729)	Nessus	Huawei Local Security Checks	high
155485	EulerOS Virtualization 2.9.0 : edk2 (EulerOS-SA-2021-2764)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2021-28216

high

Tenable Plugins

high

high

high

high