Skip to content
OpenAdvisories
Medium ALAS2-2025-2996 1 CVE

Moderate: edk2 security update (Amazon Linux 2)

Published Sep 8, 2025 · Updated Sep 16, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-38805: EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 edk2-aarch64 0:20240813-303.amzn2
Amazon Linux · 2 edk2-debuginfo 0:20240813-303.amzn2
Amazon Linux · 2 edk2-ovmf 0:20240813-303.amzn2
Amazon Linux · 2 edk2-tools 0:20240813-303.amzn2
Amazon Linux · 2 edk2-tools-doc 0:20240813-303.amzn2

Vulnerabilities 1

  • Medium 6.3
    CVE-2024-38805

    iSCSI Remote Memory Corruption and Denial of Service

    EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.

    TianoCore EDK2 edk2 edk2 Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-38805.html