Skip to content
OpenAdvisories
High RHSA-2024:3017 8 CVEs

Red Hat Security Advisory: edk2 security update

Published Sep 23, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream edk2 0:20220126gitbb1bba3d77-13.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream edk2-aarch64 0:20220126gitbb1bba3d77-13.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream edk2-ovmf 0:20220126gitbb1bba3d77-13.el8_10

Vulnerabilities 8

  • High 8.3
    CVE-2023-45235

    Buffer Overflow in EDK II Network Package

    EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Con…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-45232

    Infinite loop in EDK II Network Package

    EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Av…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-45233

    Infinite loop in EDK II Network Package

    EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Avail…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2022-36763

    Heap Buffer Overflow in Tcg2MeasureGptTable

    EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2022-36764

    Heap Buffer Overflow in Tcg2MeasurePeImage

    EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or …

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2022-36765

    Integer Overflow in CreateHob

    EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, a…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2023-45229

    Out-of-Bounds Read in EDK II Network Package

    EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2023-45231

    Out-of-Bounds Read in EDK II Network Package

    EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing  Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2257582
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2257583
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2257584
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2258677
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2258688
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2258691
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2258694
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2258700
  • article
    https://issues.redhat.com/browse/RHEL-12626
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3017.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-36763
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-36763
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-36763
  • article
    https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr
  • report
    https://access.redhat.com/security/cve/CVE-2022-36764
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-36764
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-36764
  • article
    https://github.com/tianocore/edk2/security/advisories/GHSA-4hcq-p8q8-hj8j
  • report
    https://access.redhat.com/security/cve/CVE-2022-36765
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-36765
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-36765
  • article
    https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx
  • report
    https://access.redhat.com/security/cve/CVE-2023-45229
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-45229
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-45229
  • article
    https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
  • article
    https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
  • report
    https://access.redhat.com/security/cve/CVE-2023-45231
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-45231
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-45231
  • advisory
    https://github.com/advisories/GHSA-pr27-mhpp-2ccr
  • report
    https://access.redhat.com/security/cve/CVE-2023-45232
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-45232
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-45232
  • advisory
    https://github.com/advisories/GHSA-3r3p-444m-2g4p
  • report
    https://access.redhat.com/security/cve/CVE-2023-45233
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-45233