Red Hat Security Advisory

RHSA-2024:9088

edk2 security update

Released 2024-11-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 9) edk2-aarch64-20240524-6.el9_5, edk2-ovmf-20240524-6.el9_5, edk2-tools-20240524-6.el9_5 +1
Red Hat Enterprise Linux AppStream (v. 9) edk2-20240524-6.el9_5, edk2-aarch64-20240524-6.el9_5, edk2-ovmf-20240524-6.el9_5

Fixes 4 records

TI-2024-01208 CVE-2024-1298 · GHSA-xvcj-qw55-xx42

Integer Overflow caused by divide by zero during S3 suspension

MEDIUM 60

EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access.

CVSS 3.1MEDIUM 6.0 Local High privileges No interaction EPSS 0.00219 Published 2024-05-30 Fixed in edk2-stable202405 CWE-369

TI-2023-05634 CVE-2023-6129 · GHSA-rj8q-prqp-jwfg

POLY1305 MAC implementation corrupts vector registers on PowerPC

LOW 33

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instruct…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02323 Published 2024-01-09 Partial fix · 3.2.1, 3.1.5 +1 CWE-440

TI-2024-00667 CVE-2024-0727 · GHSA-9v9h-cgj8-h64p

PKCS12 Decoding crashes

LOW 31

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sourc…

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.03187 Published 2024-01-26 Partial fix · 3.2.1, 3.1.5 +4 CWE-476

TI-2023-05728 CVE-2023-6237 · GHSA-hvc4-mjv4-5mw6

Excessive time spent checking invalid RSA public keys

LOW 31

Issue summary: Checking excessively long invalid RSA public keys may take a long time.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02303 Published 2024-04-25 Fixed in 3.0.13, 3.1.5 +1 CWE-606