8.8 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.4 High
AI Score
Confidence
Low
0.006 Low
EPSS
Percentile
78.4%
Marc Beatove discovered buffer overflows exit in EDK2. An attacker on the
local network could potentially use this to impact availability or possibly
cause remote code execution. (CVE-2022-36763, CVE-2022-36764,
CVE-2022-36765)
It was discovered that a buffer overflows exists in EDK2’s Network Package
An attacker on the local network could potentially use these to impact
availability or possibly cause remote code execution. (CVE-2023-45230,
CVE-2023-45234, CVE-2023-45235)
It was discovered that an out-of-bounds read exists in EDK2’s Network
Package An attacker on the local network could potentially use this to
impact confidentiality. (CVE-2023-45231)
It was discovered that infinite-loops exists in EDK2’s Network Package
An attacker on the local network could potentially use these to impact
availability. (CVE-2023-45232, CVE-2023-45233)
Mate Kukri discovered that an insecure default to allow UEFI Shell in
EDK2 was left enabled in Ubuntu’s EDK2. An attacker could use this to
bypass Secure Boot. (CVE-2023-48733)
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Ubuntu | 23.10 | noarch | efi-shell-aa64 | < 2023.05-2ubuntu0.1 | UNKNOWN |
Ubuntu | 23.10 | noarch | efi-shell-arm | < 2023.05-2ubuntu0.1 | UNKNOWN |
Ubuntu | 23.10 | noarch | efi-shell-ia32 | < 2023.05-2ubuntu0.1 | UNKNOWN |
Ubuntu | 23.10 | noarch | efi-shell-x64 | < 2023.05-2ubuntu0.1 | UNKNOWN |
Ubuntu | 23.10 | noarch | ovmf | < 2023.05-2ubuntu0.1 | UNKNOWN |
Ubuntu | 23.10 | noarch | ovmf-ia32 | < 2023.05-2ubuntu0.1 | UNKNOWN |
Ubuntu | 23.10 | noarch | qemu-efi-aarch64 | < 2023.05-2ubuntu0.1 | UNKNOWN |
Ubuntu | 23.10 | noarch | qemu-efi-arm | < 2023.05-2ubuntu0.1 | UNKNOWN |
Ubuntu | 22.04 | noarch | ovmf | < 2022.02-3ubuntu0.22.04.2 | UNKNOWN |
Ubuntu | 22.04 | noarch | ovmf-ia32 | < 2022.02-3ubuntu0.22.04.2 | UNKNOWN |
bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137
ubuntu.com/security/CVE-2022-36763
ubuntu.com/security/CVE-2022-36764
ubuntu.com/security/CVE-2022-36765
ubuntu.com/security/CVE-2023-45230
ubuntu.com/security/CVE-2023-45231
ubuntu.com/security/CVE-2023-45232
ubuntu.com/security/CVE-2023-45233
ubuntu.com/security/CVE-2023-45234
ubuntu.com/security/CVE-2023-45235
ubuntu.com/security/CVE-2023-48733
8.8 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.4 High
AI Score
Confidence
Low
0.006 Low
EPSS
Percentile
78.4%