Skip to content
OpenAdvisories
High ALAS2-2025-2975 1 CVE

Important: edk2 security update (Amazon Linux 2)

Published Aug 13, 2025 · Updated Aug 19, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-3770: EDK2 contains a vulnerability in BIOS where an attacker may cause "Protection Mechanism Failure" by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 edk2-aarch64 0:20240813-302.amzn2
Amazon Linux · 2 edk2-debuginfo 0:20240813-302.amzn2
Amazon Linux · 2 edk2-ovmf 0:20240813-302.amzn2
Amazon Linux · 2 edk2-tools 0:20240813-302.amzn2
Amazon Linux · 2 edk2-tools-doc 0:20240813-302.amzn2

Vulnerabilities 1

  • High 7.0
    CVE-2025-3770

    SMM IDT Privilege Escalation Vulnerability

    EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-3770.html