Summary
It was discovered that EDK II was susceptible to a predictable TCP Initial
Sequence Number. An attacker could possibly use this issue to gain
unauthorized access. This issue only affected Ubuntu 22.04 LTS, and Ubuntu
24.04 LTS. (CVE-2023-45236, CVE-2023-45237)
It was discovered that EDK II incorrectly handled S3 sleep. An attacker
could possibly use this issue to cause a denial of service. This issue only
affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-1298)
It was discovered that the EDK II PE/COFF loader incorrectly handled
certain memory operations. An attacker could possibly use this issue to
cause a denial of service, obtain sensitive information, or execute
arbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu
24.04 LTS. (CVE-2024-38796)
It was discovered that the EDK II PE image hashing function incorrectly
handled certain memory operations. An attacker could possibly use this
issue to cause a denial of service, or execute arbitrary code.
(CVE-2024-38797)
It was discovered that the EDK II BIOS incorrectly handled certain memory
operations. An attacker could possibly use this issue to cause a denial of
service. (CVE-2024-38805, CVE-2025-2295)
It was discovered that EDK II incorrectly handled the enabling of MCE. An
attacker could possibly use this issue to cause a denial of service, or
execute arbitrary code. (CVE-2025-3770)
It was discovered that the OpenSSL library embedded in EDK II contained
multiple vulnerabilties. An attacker could possibly use these issues to
cause a denial of service, obtain sensitive information, or execute
arbitrary code. (CVE-2021-3712, CVE-2022-0778, CVE-2022-4304,
CVE-2022-4450, CVE-2023-0215, CVE-2023-0286, CVE-2023-0464, CVE-2023-0465,
CVE-2023-0466, CVE-2023-2650, CVE-2023-3446, CVE-2023-3817, CVE-2023-5678,
CVE-2023-6237, CVE-2024-0727, CVE-2024-13176, CVE-2024-2511,
CVE-2024-41996, CVE-2024-4741, CVE-2024-5535, CVE-2024-6119, CVE-2024-9143,
CVE-2025-9232)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | edk2 | 2022.02-3ubuntu0.22.04.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | edk2 | 2024.02-2ubuntu0.6 |
Vulnerabilities 30
-
Critical 9.8
Use After Free with SSL_free_buffers
Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, cra…
-
Critical 9.1CVE-2024-5535 Public exploit
SSL_select_next_proto buffer overread
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…
-
High 8.8CVE-2024-9143 EPSS 12%
Low-level invalid GF(2^m) parameters lead to OOB memory access
Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a pos…
-
High 7.5
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…
-
High 7.5CVE-2022-4450 EPSS 29%
Double free after calling PEM_read_bio_ex
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to…
-
High 7.5
Use-after-free following BIO_new_NDEF
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.…
-
High 7.5CVE-2023-0464 Public exploit
Excessive Resource Usage Verifying X.509 Policy Constraints
A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …
-
High 7.5CVE-2024-6119 EPSS 67%
Possible denial of service in X.509 name checks
Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of…
-
High 7.4
Read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…
-
High 7.4
X.400 address type confusion in X.509 GeneralName
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…
-
High 7.0
SMM IDT Privilege Escalation Vulnerability
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.
-
Medium 6.5CVE-2023-2650 EPSS 75%
Possible DoS translating ASN.1 object identifiers
Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …
-
Medium 6.3
iSCSI Remote Memory Corruption and Denial of Service
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
-
Medium 6.0
Integer Overflow caused by divide by zero during S3 suspension
EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.
-
Medium 5.9
Timing Oracle in RSA Decryption
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …
-
Medium 5.9
Excessive time spent checking invalid RSA public keys
Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been…
-
Medium 5.9CVE-2024-2511 EPSS 59%
Unbounded memory growth with session handling in TLSv1.3
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial o…
-
Medium 5.9
Integer overflow in PeCoffLoaderRelocateImage
EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availabil…
-
Medium 5.9
Out-of-bounds read in HTTP client no_proxy handling
Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An ou…
-
Medium 5.8
Predictable TCP ISNs in EDK II Network Package
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
-
Medium 5.5
PKCS12 Decoding crashes
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in …
-
Medium 5.3
Invalid certificate policies in leaf certificates are silently ignored
Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate pol…
-
Medium 5.3
Certificate policy check not enabled
The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or in…
-
Medium 5.3
Excessive time spent checking DH keys and parameters
Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…
-
Medium 5.3
Excessive time spent checking DH q parameter value
Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…
-
Medium 5.3
Use of a Weak PseudoRandom Number Generator in EDK II Network Package
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
-
Medium 5.3
Excessive time spent in DH check / generation with large Q parameter value
Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…
-
Medium 4.6CVE-2024-13176 Public exploit
Timing side-channel in ECDSA signature computation
Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacke…
-
Medium 4.6
Out-of-bounds Read in HashPeImageByType()
EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availa…
-
Low 3.5
Potential iSCSI R2T PDU Vulnerability
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
References
-
report
https://ubuntu.com/security/CVE-2021-3712
-
report
https://ubuntu.com/security/CVE-2022-0778
-
report
https://ubuntu.com/security/CVE-2022-4304
-
report
https://ubuntu.com/security/CVE-2022-4450
-
report
https://ubuntu.com/security/CVE-2023-0215
-
report
https://ubuntu.com/security/CVE-2023-0286
-
report
https://ubuntu.com/security/CVE-2023-0464
-
report
https://ubuntu.com/security/CVE-2023-0465
-
report
https://ubuntu.com/security/CVE-2023-0466
-
report
https://ubuntu.com/security/CVE-2023-2650
-
report
https://ubuntu.com/security/CVE-2023-3446
-
report
https://ubuntu.com/security/CVE-2023-3817
-
report
https://ubuntu.com/security/CVE-2023-5678
-
report
https://ubuntu.com/security/CVE-2023-6237
-
report
https://ubuntu.com/security/CVE-2023-45236
-
report
https://ubuntu.com/security/CVE-2023-45237
-
report
https://ubuntu.com/security/CVE-2024-0727
-
report
https://ubuntu.com/security/CVE-2024-1298
-
report
https://ubuntu.com/security/CVE-2024-2511
-
report
https://ubuntu.com/security/CVE-2024-4741
-
report
https://ubuntu.com/security/CVE-2024-5535
-
report
https://ubuntu.com/security/CVE-2024-6119
-
report
https://ubuntu.com/security/CVE-2024-9143
-
report
https://ubuntu.com/security/CVE-2024-13176
-
report
https://ubuntu.com/security/CVE-2024-38796
-
report
https://ubuntu.com/security/CVE-2024-38797
-
report
https://ubuntu.com/security/CVE-2024-38805
-
report
https://ubuntu.com/security/CVE-2025-2295
-
report
https://ubuntu.com/security/CVE-2025-3770
-
report
https://ubuntu.com/security/CVE-2025-9232