Skip to content
OpenAdvisories
Medium ALAS2-2025-2852 1 CVE

Moderate: edk2 security update (Amazon Linux 2)

Published May 8, 2025 · Updated May 13, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-38797: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 edk2-aarch64 0:20240813-301.amzn2
Amazon Linux · 2 edk2-debuginfo 0:20240813-301.amzn2
Amazon Linux · 2 edk2-ovmf 0:20240813-301.amzn2
Amazon Linux · 2 edk2-tools 0:20240813-301.amzn2
Amazon Linux · 2 edk2-tools-doc 0:20240813-301.amzn2

Vulnerabilities 1

  • Medium 4.6
    CVE-2024-38797

    Out-of-bounds Read in HashPeImageByType()

    EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availa…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-38797.html