Red Hat Security Advisory

RHSA-2024:4749

edk2 security update

Released 2024-07-23 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) edk2-20231122-6.el9_4.2, edk2-aarch64-20231122-6.el9_4.2, edk2-ovmf-20231122-6.el9_4.2
Red Hat Enterprise Linux CRB (v. 9) edk2-aarch64-20231122-6.el9_4.2, edk2-ovmf-20231122-6.el9_4.2, edk2-tools-20231122-6.el9_4.2 +1

Fixes 3 records

TI-2023-24242 CVE-2023-45237 · GHSA-fxqf-p2p3-gxvr

Use of a Weak PseudoRandom Number Generator in EDK II Network Package

MEDIUM 41

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00994 Published 2024-01-16 Fixed CWE-338

TI-2023-24241 CVE-2023-45236 · GHSA-fqc4-ffq5-4r98

Predictable TCP ISNs in EDK II Network Package

MEDIUM 41

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00994 Published 2024-01-16 Fixed CWE-200

TI-2022-17009 CVE-2022-36765

Integer Overflow in CreateHob

LOW 34

EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0029 Published 2024-01-09 Fixed CWE-680