CloverHackyColor CloverBootloader Out-of-Bounds Read Vulnerability

An out-of-bounds read vulnerability has been identified in CloverHackyColor CloverBootloader versions prior to 5162. This issue arises in the MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules, specifically within the regparse.C program file. The vulnerability allows for a heap-buffer overflow in the 'fetch_interval_quantifier()' function, due to a double PFETCH instruction, which could potentially be exploited to read memory outside the intended bounds.

Impact

Exploitation of this vulnerability leads to a heap-buffer overflow, which can commonly be exploited to execute arbitrary code or cause a denial-of-service condition.

Remediation

Users can update to CloverHackyColor CloverBootloader version 5162 or later to address this vulnerability.