Read the docs
Red Hat Security Advisory

RHSA-2024:2264

edk2 security update

Released 2024-04-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 8 records

TI-2023-24240 CVE-2023-45235 · GHSA-h9v6-q439-p7j2

Buffer Overflow in EDK II Network Package

Priority HIGH 79

EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.01223 Published 2024-01-16 Fixed CWE-119
TI-2023-24238 CVE-2023-45233 · GHSA-p9h6-p7cr-7842

Infinite loop in EDK II Network Package

Priority HIGH 74

EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02084 Published 2024-01-16 Fixed CWE-835
TI-2023-24236 CVE-2023-45231 · GHSA-pr27-mhpp-2ccr

Out-of-Bounds Read in EDK II Network Package

Priority MEDIUM 62

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00849 Published 2024-01-16 Fixed CWE-125
TI-2023-24237 CVE-2023-45232 · GHSA-3r3p-444m-2g4p

Infinite loop in EDK II Network Package

Priority MEDIUM 43

EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02084 Published 2024-01-16 Fixed CWE-835
TI-2023-03220 CVE-2023-3446 · GHSA-3p3x-vg38-6g9q

Excessive time spent checking DH keys and parameters

Priority LOW 39

Issue summary: Checking excessively long DH keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.06531 Published 2023-07-19 Partial fix · 3.1.2, 3.0.10 +2 CWE-606
TI-2022-17008 CVE-2022-36764

Heap Buffer Overflow in Tcg2MeasurePeImage

Priority LOW 36

EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0029 Published 2024-01-09 Fixed CWE-122
TI-2022-17007 CVE-2022-36763

Heap Buffer Overflow in Tcg2MeasureGptTable

Priority LOW 34

EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00291 Published 2024-01-09 Fixed CWE-122
TI-2023-24234 CVE-2023-45229

Out-of-Bounds Read in EDK II Network Package

Priority LOW 31

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00972 Published 2024-01-16 Fixed CWE-125