There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version < P13 (latest) and AP130 F2 firmware version < P04 (latest) and Aspire 1600X firmware version < P11.A3L (latest) and Aspire 1602M firmware version < P11.A3L (latest) and Aspire 7600U firmware version < P11.A4 (latest) and Aspire MC605 firmware version < P11.A4L (latest) and Aspire TC-105 firmware version < P12.B0L (latest) and Aspire TC-120 firmware version < P11-A4 (latest) and Aspire U5-620 firmware version < P11.A1 (latest) and Aspire X1935 firmware version < P11.A3L (latest) and Aspire X3475 firmware version < P11.A3L (latest) and Aspire X3995 firmware version < P11.A3L (latest) and Aspire XC100 firmware version < P11.B3 (latest) and Aspire XC600 firmware version < P11.A4 (latest) and Aspire Z3-615 firmware version < P11.A2L (latest) and Veriton E430G firmware version < P21.A1 (latest) and Veriton B630_49 firmware version < AAP02SR (latest) and Veriton E430 firmware version < P11.A4 (latest) and Veriton M2110G firmware version < P21.A3 (latest) and Veriton M2120G fir.
Publication date: Fri, 23 Sep 2022 05:15:00 +0000