Skip to content
OpenAdvisories
Medium ALAS2-2024-2578 1 CVE

Moderate: edk2 security update (Amazon Linux 2)

Published Jun 19, 2024 · Updated Jun 24, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-1298: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 edk2-aarch64 0:20200801stable-1.amzn2.0.7
Amazon Linux · 2 edk2-debuginfo 0:20200801stable-1.amzn2.0.7
Amazon Linux · 2 edk2-ovmf 0:20200801stable-1.amzn2.0.7
Amazon Linux · 2 edk2-tools 0:20200801stable-1.amzn2.0.7
Amazon Linux · 2 edk2-tools-doc 0:20200801stable-1.amzn2.0.7
Amazon Linux · 2 edk2-tools-python 0:20200801stable-1.amzn2.0.7

Vulnerabilities 1

  • Medium 6.0
    CVE-2024-1298

    Integer Overflow caused by divide by zero during S3 suspension

    EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-1298.html