Read the docs
TI-2025-02161 Aliases CVE-2025-2486GHSA-g658-h443-xpr6

UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu

Priority LOW 17CWE-489Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some previous versions inserted a secure-boot-based decision to continue running inside the Shell itself, which is believed to be sufficient to enforce Secure Boot restrictions. This is an additional repair on top of the incomplete fix for CVE-2023-48733.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00139 3rd percentileScored 2026-11-07
Fix Fixed edk2 (Ubuntu): 2024.05-2ubuntu0.3, 2024.02-2ubuntu0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ubuntuedk22024.05 to before 2024.05-2ubuntu0.3; 2024.02 to before 2024.02-2ubuntu0.32024.05-2ubuntu0.3, 2024.02-2ubuntu0.3Patch availableCNA
  • edk2 VendorUbuntu Affected 2024.05 to before 2024.05-2ubuntu0.3; 2024.02 to before 2024.02-2ubuntu0.3 Fixed in 2024.05-2ubuntu0.3, 2024.02-2ubuntu0.3 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:tianocore:edk2:202402*:*:*:*:*:*:*:*202402*VulnerableTianoCore
cpe:2.3:a:tianocore:edk2:202405:*:*:*:*:*:*:*202405VulnerableTianoCore
  • cpe:2.3:a:tianocore:edk2:202402*:*:*:*:*:*:*:* Versions 202402* Vulnerable ·TianoCore
  • cpe:2.3:a:tianocore:edk2:202405:*:*:*:*:*:*:* Versions 202405 Vulnerable ·TianoCore

Remediation

  • Fix · CNA edk2 (Ubuntu) Fixed in 2024.05-2ubuntu0.3, 2024.02-2ubuntu0.3

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-2486
  2. 2026-10-03 Alias added: GHSA-g658-h443-xpr6

References

Patch 1

  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
  • TI-2004-01032 Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and… CVSS 2.0HIGH 10.0
  • TI-2004-00896 Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other… CVSS 2.0HIGH 10.0
  • TI-2004-00800 Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may… CVSS 2.0HIGH 10.0
  • TI-2004-00962 Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to… CVSS 2.0HIGH 10.0
See all 129 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences