Summary
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.
Security Fix(es):
* openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)
* edk2: integer underflow in SmmEntryPoint function leads to potential SMM privilege escalation (CVE-2021-38578)
* openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)
* openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)
* openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | edk2-aarch64 | 20221207gitfff6d81270b5-9.el9_2 |
| AlmaLinux · 9 | edk2-ovmf | 20221207gitfff6d81270b5-9.el9_2 |
| AlmaLinux · 9 | edk2-tools | 20221207gitfff6d81270b5-9.el9_2 |
| AlmaLinux · 9 | edk2-tools-doc | 20221207gitfff6d81270b5-9.el9_2 |
Vulnerabilities 5
-
High 7.5CVE-2022-4450 EPSS 29%
Double free after calling PEM_read_bio_ex
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to…
-
High 7.5
Use-after-free following BIO_new_NDEF
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.…
-
High 7.4
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
-
High 7.4
X.400 address type confusion in X.509 GeneralName
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…
-
Medium 5.9
Timing Oracle in RSA Decryption
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …
References
-
report
https://access.redhat.com/security/cve/CVE-2021-38578
-
report
https://access.redhat.com/security/cve/CVE-2022-4304
-
report
https://access.redhat.com/security/cve/CVE-2022-4450
-
report
https://access.redhat.com/security/cve/CVE-2023-0215
-
report
https://access.redhat.com/security/cve/CVE-2023-0286
-
report
https://bugzilla.redhat.com/1960321
-
report
https://bugzilla.redhat.com/2164440
-
report
https://bugzilla.redhat.com/2164487
-
report
https://bugzilla.redhat.com/2164492
-
report
https://bugzilla.redhat.com/2164494
-
advisory
https://errata.almalinux.org/9/ALSA-2023-2165.html