Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-36764: EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. CVE-2022-36763: EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | edk2-aarch64 | 0:20200801stable-1.amzn2.0.3 |
| Amazon Linux · 2 | edk2-debuginfo | 0:20200801stable-1.amzn2.0.3 |
| Amazon Linux · 2 | edk2-ovmf | 0:20200801stable-1.amzn2.0.3 |
| Amazon Linux · 2 | edk2-tools | 0:20200801stable-1.amzn2.0.3 |
| Amazon Linux · 2 | edk2-tools-doc | 0:20200801stable-1.amzn2.0.3 |
| Amazon Linux · 2 | edk2-tools-python | 0:20200801stable-1.amzn2.0.3 |
Vulnerabilities 2
-
High 7.0
Heap Buffer Overflow in Tcg2MeasureGptTable
EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or…
-
High 7.0
Heap Buffer Overflow in Tcg2MeasurePeImage
EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or …