CVE-2021-38575 Memory corruption in EDK II

High 8.1 Published 1 Dec 2021 Updated 3 Nov 2025

Remote attackers can exploit buffer overflows in the EDK II iSCSI driver to execute arbitrary code on affected systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-38575?

CVE-2021-38575 is a high-severity memory corruption vulnerability in TianoCore EDK II, published on 1 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.

Weakness: CWE-119, CWE-124

Which versions are affected by CVE-2021-38575?

It affects 2 products.

Linux distribution packages (10)

`edk2` Red Hat:enterprise_linux:8::appstream	All versions	`0:20200602gitca407c7246bf-4.el8_4.2`
`edk2-aarch64` Red Hat:enterprise_linux:8::appstream	All versions	`0:20200602gitca407c7246bf-4.el8_4.2`
`edk2-ovmf` Red Hat:enterprise_linux:8::appstream	All versions	`0:20200602gitca407c7246bf-4.el8_4.2`
`edk2` Red Hat:rhel_eus:8.1::appstream	All versions	`0:20190308git89910a39dcfd-6.el8_1.1`
`edk2-aarch64` Red Hat:rhel_eus:8.1::appstream	All versions	`0:20190308git89910a39dcfd-6.el8_1.1`
`edk2-ovmf` Red Hat:rhel_eus:8.1::appstream	All versions	`0:20190308git89910a39dcfd-6.el8_1.1`
`edk2` Red Hat:rhel_eus:8.2::appstream	All versions	`0:20190829git37eef91017ad-9.el8_2.1`
`edk2-aarch64` Red Hat:rhel_eus:8.2::appstream	All versions	`0:20190829git37eef91017ad-9.el8_2.1`
`edk2-ovmf` Red Hat:rhel_eus:8.2::appstream	All versions	`0:20190829git37eef91017ad-9.el8_2.1`
`edk2` Rocky Linux:8	All versions	`0:20200602gitca407c7246bf-4.el8_4.2`

Products include Insyde Kernel, Tianocore Edk2.

How do I fix CVE-2021-38575?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-38575 being exploited?

There is no known exploitation of CVE-2021-38575 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2021-38575, GHSA-7cjm-mv56-4mg4, OESA-2021-1358, RHSA-2021:3066, RHSA-2021:3172, RHSA-2021:3369 and 2 more.