EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
Weakness
The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Edk2 | Tianocore | * | 202311 (including) |
| Red Hat Enterprise Linux 8 | RedHat | edk2-0:20220126gitbb1bba3d77-13.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | edk2-0:20231122-6.el9_4.2 | * |
| Edk2 | Ubuntu | bionic | * |
| Edk2 | Ubuntu | esm-infra/focal | * |
| Edk2 | Ubuntu | focal | * |
| Edk2 | Ubuntu | jammy | * |
| Edk2 | Ubuntu | lunar | * |
| Edk2 | Ubuntu | mantic | * |
| Edk2 | Ubuntu | trusty | * |
| Edk2 | Ubuntu | xenial | * |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/10.html
- https://cwe.mitre.org/data/definitions/100.html
- https://cwe.mitre.org/data/definitions/14.html
- https://cwe.mitre.org/data/definitions/24.html
- https://cwe.mitre.org/data/definitions/45.html
- https://cwe.mitre.org/data/definitions/46.html
- https://cwe.mitre.org/data/definitions/47.html
- https://cwe.mitre.org/data/definitions/67.html
- https://cwe.mitre.org/data/definitions/8.html
- https://cwe.mitre.org/data/definitions/9.html
- https://cwe.mitre.org/data/definitions/92.html
References
- https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
- https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx
- https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/