Read the docs
TI-2024-26029 Aliases CVE-2024-38796

Integer overflow in PeCoffLoaderRelocateImage

Priority LOW 27CWE-122Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0037 31st percentileScored 2026-11-07
Fix Fixed Red Hat: 9 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TianoCoreEDK2up to edk2-stable202405—No fix listedCNA
  • EDK2 VendorTianoCore Affected up to edk2-stable202405 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*——TianoCore
  • cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:* Versions — — ·TianoCore

Remediation

Red Hat 9 advisories

  • RHSA-2024:11219 Released 2024-12-17 · Red Hat rating Moderate
    edk2:20240524 security update
    • Red Hat CodeReady Linux Builder (v. 9) edk2-aarch64-20240524-6.el9_5.3, edk2-ovmf-20240524-6.el9_5.3, edk2-tools-20240524-6.el9_5.3 +1
    • Red Hat Enterprise Linux AppStream (v. 9) edk2-20240524-6.el9_5.3, edk2-aarch64-20240524-6.el9_5.3, edk2-ovmf-20240524-6.el9_5.3
  • RHSA-2024:11185 Released 2024-12-17 · Red Hat rating Moderate
    edk2:20220126gitbb1bba3d77 security update
    • Red Hat Enterprise Linux AppStream (v. 8) edk2-20220126gitbb1bba3d77-13.el8_10.4, edk2-aarch64-20220126gitbb1bba3d77-13.el8_10.4, edk2-ovmf-20220126gitbb1bba3d77-13.el8_10.4
  • RHSA-2024:11194 Released 2024-12-17 · Red Hat rating Moderate
    edk2 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) edk2-20220126gitbb1bba3d77-2.el8_6.7, edk2-ovmf-20220126gitbb1bba3d77-2.el8_6.7
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) edk2-20220126gitbb1bba3d77-2.el8_6.7, edk2-aarch64-20220126gitbb1bba3d77-2.el8_6.7, edk2-ovmf-20220126gitbb1bba3d77-2.el8_6.7
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) edk2-20220126gitbb1bba3d77-2.el8_6.7, edk2-ovmf-20220126gitbb1bba3d77-2.el8_6.7
Show 6 more Red Hat advisories
  • RHSA-2024:10268 Released 2024-11-26 · Red Hat rating Moderate
    edk2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) edk2-20220126gitbb1bba3d77-4.el8_8.7, edk2-aarch64-20220126gitbb1bba3d77-4.el8_8.7, edk2-ovmf-20220126gitbb1bba3d77-4.el8_8.7
  • RHSA-2024:10272 Released 2024-11-26 · Red Hat rating Moderate
    edk2 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) edk2-20200602gitca407c7246bf-4.el8_4.7, edk2-ovmf-20200602gitca407c7246bf-4.el8_4.7
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) edk2-20200602gitca407c7246bf-4.el8_4.7, edk2-ovmf-20200602gitca407c7246bf-4.el8_4.7
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) edk2-20200602gitca407c7246bf-4.el8_4.7, edk2-ovmf-20200602gitca407c7246bf-4.el8_4.7
  • RHSA-2024:9956 Released 2024-11-19 · Red Hat rating Moderate
    edk2 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) edk2-aarch64-20221207gitfff6d81270b5-9.el9_2.5, edk2-ovmf-20221207gitfff6d81270b5-9.el9_2.5, edk2-tools-20221207gitfff6d81270b5-9.el9_2.5 +1
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) edk2-20221207gitfff6d81270b5-9.el9_2.5, edk2-aarch64-20221207gitfff6d81270b5-9.el9_2.5, edk2-ovmf-20221207gitfff6d81270b5-9.el9_2.5
  • RHSA-2024:9921 Released 2024-11-19 · Red Hat rating Moderate
    edk2 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) edk2-aarch64-20231122-6.el9_4.6, edk2-ovmf-20231122-6.el9_4.6, edk2-tools-20231122-6.el9_4.6 +1
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) edk2-20231122-6.el9_4.6, edk2-aarch64-20231122-6.el9_4.6, edk2-ovmf-20231122-6.el9_4.6
  • RHSA-2024:9946 Released 2024-11-19 · Red Hat rating Moderate
    edk2 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) edk2-20190829git37eef91017ad-9.el8_2.6, edk2-ovmf-20190829git37eef91017ad-9.el8_2.6
  • RHSA-2024:9930 Released 2024-11-19 · Red Hat rating Moderate
    edk2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) edk2-20220126gitbb1bba3d77-3.el9_0.6, edk2-aarch64-20220126gitbb1bba3d77-3.el9_0.6, edk2-ovmf-20220126gitbb1bba3d77-3.el9_0.6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2024:11219
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:9956
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2024:9921
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:11185
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:11219
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:9946
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:10272
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:11194
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:10272
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:11194
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:9930
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:10268
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:9956
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2024:9921
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:10272
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:11194
Not affected: 1 product
  • Red Hat Enterprise Linux 10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-38796

References

Other 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-24240 Buffer Overflow in EDK II Network Package CVSS 3.1HIGH 8.8
  • TI-2023-24238 Infinite loop in EDK II Network Package CVSS 3.1HIGH 7.5
  • TI-2023-24235 Buffer Overflow in EDK II Network Package CVSS 3.1HIGH 8.8
  • TI-2023-26565 An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. CVSS 3.1MEDIUM 6.7
  • TI-2023-24236 Out-of-Bounds Read in EDK II Network Package CVSS 3.1MEDIUM 6.5
See all 53 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences