CVE-2022-36765 Integer Overflow in CreateHob

EDK2 is susceptible to a vulnerability in the CreateHob function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability...

CVE-2022-36764

EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability...

PT-2024-1801 · Edk2 +10 · Edk2 +10

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to a heap buffer overflow vulnerability in the Tcg2MeasurePeImage function. This vulnerability can be triggered via a local network, potentially compromising...

PT-2024-1803

Name of the Vulnerable Software and Affected Versions EDK2 affected versions not specified Description The issue is related to the CreateHob function in EDK2, which is susceptible to an integer overflow that can lead to a buffer overflow. This can be triggered via a local network, potentially...

PT-2023-8396 · Edk2 +11 · Edk2 +11

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to an infinite loop vulnerability in EDK2's Network Package when parsing a PadN option in the Destination Options header of IPv6. This can be exploited by an attacker to...

edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe

A flaw was found in edk2. Missing checks in the IScsiHexToBin function in NetworkPkg/IScsiDxe lead to a buffer overflow allowing a remote attacker, who can inject himself in the communication between edk2 and the iSCSI target, to write arbitrary data to any address in the edk2 firmware and...

PT-2021-6806 · Edk2 +2 · Edk2 +2

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to the function FpdtStatusCodeListenerPei in the open-source UEFI EDK2 development environment. It involves the release of an incorrect pointer, which can be exploited by ...

Denial Of Service (DoS)

edk2 is vulnerable to denial of service DoS. It is due to stack overflow in XHCI causing denial of service...

edk2: Buffer Overflow in BlockIo service for RAM disk

A flaw was found in edk2. When registering a RAM disk whose size is not a multiple of 512 bytes, the BlockIo protocol produced by the RamDiskDxe driver will incur memory read/write overrun. The memory overrun will happen when reading/writing the last block on the RAM disk. The highest threat from...

RHEL 7 : ovmf (RHSA-2019:0809)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0809 advisory. OVMF Open Virtual Machine Firmware is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for...

PT-2021-7868 · Edk2 +8 · Edk2 +8

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to a buffer overflow in the SmmEntryPoint function of the open-source UEFI EDK2 development environment. This allows a remote attacker to access confidential data,...

PT-2021-4745 · Tianocore +8 · Tianocore Edk2 +8

Name of the Vulnerable Software and Affected Versions: NetworkPkg/IScsiDxe affected versions not specified Tianocore edk2 affected versions not specified Description: The issue is related to remotely exploitable buffer overflows in the NetworkPkg/IScsiDxe and the IScsiHexToBin function of the...