CVE-2025-2296

Description

EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.
When secure boot is enabled, image will be verified by DxeImageVerification when it is to be loaded.
In direct boot mode if signature of linux kernel is not in the DB, DxeImageVerification returns EFI_ACCESS_DENIED. But it falls back to the legacy loader. In this case Secure Boot is bypassed.

Detailed code is QemuLoadKernelImage () @OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c.

Another related commit is:
dafce29 2020-06-06 OvmfPkg/X86QemuLoadImageLib: handle EFI_ACCESS_DENIED from LoadImage() [Laszlo Ersek]

Impact
An attacker could possibly alter control flow in unexpected ways, including arbitrary command execution.
A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, Availability.

Mitigation release plan
A patch was upstreamed into EDK2. #10628

References
Original bugzilla ticket. https://bugzilla.tianocore.org/show_bug.cgi?id=3857