CVE-2019-11098: 
Linux Debian vulnerability analysis and mitigation

Insufficient input validation in MdeModulePkg in EDKII (CVE-2019-11098) was discovered, which affects the firmware security of systems using this component. The vulnerability was initially reported on April 11, 2019, and allows an unauthenticated user to potentially exploit the system through physical access (CVE Mitre).

The vulnerability has been assigned a CVSS 3.1 Base Score of 6.8 (Medium), with the following characteristics: Physical attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on confidentiality, integrity, and availability (Ubuntu Security).

The vulnerability can lead to multiple severe consequences including escalation of privilege, denial of service, and potential information disclosure. These impacts are particularly concerning as they can be achieved through physical access to the affected systems (NVD).

Multiple vendors have released patches to address this vulnerability. Ubuntu has provided fixes in versions 2020.11-4ubuntu0.1 for Ubuntu 21.04 and 0~20191122.bd85bf54-2ubuntu3.3 for Ubuntu 20.04 LTS. After applying the updates, affected virtual machines need to be restarted to implement the security changes (Ubuntu Security Notice).