Skip to content
OpenAdvisories
Medium ALSA-2024:5297 3 CVEs

Moderate: edk2 security update

Published Aug 13, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

* edk2: Predictable TCP Initial Sequence Numbers (CVE-2023-45236)
* edk2: Use of a Weak PseudoRandom Number Generator (CVE-2023-45237)
* edk2: Temporary DoS vulnerability (CVE-2024-1298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 8 edk2-aarch64 20220126gitbb1bba3d77-13.el8_10.2
AlmaLinux · 8 edk2-ovmf 20220126gitbb1bba3d77-13.el8_10.2

Vulnerabilities 3

  • Medium 6.0
    CVE-2024-1298

    Integer Overflow caused by divide by zero during S3 suspension

    EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • Medium 5.8
    CVE-2023-45236

    Predictable TCP ISNs in EDK II Network Package

    EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2023-45237

    Use of a Weak PseudoRandom Number Generator in EDK II Network Package

    EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-45236
  • report
    https://access.redhat.com/security/cve/CVE-2023-45237
  • report
    https://access.redhat.com/security/cve/CVE-2024-1298
  • report
    https://bugzilla.redhat.com/2258703
  • report
    https://bugzilla.redhat.com/2258706
  • report
    https://bugzilla.redhat.com/2284243
  • advisory
    https://errata.almalinux.org/8/ALSA-2024-5297.html