CVE-2024-38805
iSCSI Remote Memory Corruption and Denial of Service
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
iSCSI Remote Memory Corruption and Denial of Service
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
- Record
CVE-2024-38805- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2024-54871
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
- Record
EUVD-2024-54871- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w8rg-pqpr-83hp
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by...
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
- Record
GHSA-w8rg-pqpr-83hp- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
- Record
CVE-2024-38805- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
- Record
CVE-2024-38805- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-38805
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
- Record
DEBIAN-CVE-2024-38805- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVOESA-2025-2298
edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.
Security Fix(es):
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)
- Record
OESA-2025-2298- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2299
edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.
Security Fix(es):
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)
- Record
OESA-2025-2299- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2300
edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.
Security Fix(es):
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)
- Record
OESA-2025-2300- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2386
edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.
Security Fix(es):
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)
- Record
OESA-2025-2386- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2387
edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.
Security Fix(es):
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)
- Record
OESA-2025-2387- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2388
edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.
Security Fix(es):
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)
- Record
OESA-2025-2388- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-38805
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
- Record
UBUNTU-CVE-2024-38805- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15255-1 No score
ovmf-202505-2.1 on GA media
These are all security issues fixed in the ovmf-202505-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15255-1- Updated
- 2026-11-02
OSVUSN-7894-1 No score
edk2 vulnerabilities
It was discovered that EDK II was susceptible to a predictable TCP Initial Sequence Number. An attacker could possibly use this issue to gain unauthorized access. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2023-45236, CVE-2023-45237)
It was discovered that EDK II incorrectly handled S3 sleep. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-1298)
It was discovered that the EDK II PE/COFF loader incorrectly handled certain memory operations. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-38796)
It was discovered that the EDK II PE image hashing function incorrectly handled certain memory operations. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2024-38797)
It was discovered that the EDK II BIOS incorrectly handled certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-38805, CVE-2025-2295)
It was discovered that EDK II incorrectly handled the enabling of MCE. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2025-3770)
It was discovered that the OpenSSL library embedded in EDK II contained multiple vulnerabilties. An attacker could possibly use these issues to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2021-3712, CVE-2022-0778, CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0286, CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-2650, CVE-2023-3446, CVE-2023-3817, CVE-2023-5678, CVE-2023-6237, CVE-2024-0727, CVE-2024-13176, CVE-2024-2511, CVE-2024-41996, CVE-2024-4741, CVE-2024-5535, CVE-2024-6119, CVE-2024-9143, CVE-2025-9232)
- Record
USN-7894-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
edk2Debian:12 |
All versions, plus listed versions 2022.11-62022.11-6+deb12u12022.11-6+deb12u22023.02-12023.02-2 Show 45 moreShow less2023.05-12023.05-22023.08-12023.11-12023.11-22023.11-32023.11-42023.11-52023.11-62023.11-72023.11-82024.02-12024.02-22024.05-12024.05-22024.08-12024.08-22024.08-32024.08-42024.11-12024.11-22024.11-32024.11-42024.11-52025.02-12025.02-102025.02-22025.02-32025.02-42025.02-52025.02-62025.02-72025.02-82025.02-92025.05-12025.05-22025.08.01-12025.08.01-22025.08.01-32025.08.01-42025.08.01-52025.08.01-62025.11-12025.11-22025.11-3 |
None known |
edk2Debian:13 |
before 2025.02-8+deb13u1, plus listed versions 2025.02-8 |
2025.02-8+deb13u1 |
edk2Debian:14 |
before 2025.02-9, plus listed versions 2025.02-8 |
2025.02-9 |
edk2openEuler:24.03-LTS |
before 202308-28.oe2403 | 202308-28.oe2403 |
edk2openEuler:20.03-LTS-SP4 |
before 202002-32.oe2003sp4 | 202002-32.oe2003sp4 |
edk2openEuler:22.03-LTS-SP4 |
before 202011-28.oe2203sp4 | 202011-28.oe2203sp4 |
edk2openEuler:24.03-LTS-SP2 |
before 202308-26.oe2403sp2 | 202308-26.oe2403sp2 |
edk2openEuler:22.03-LTS-SP3 |
before 202011-29.oe2203sp3 | 202011-29.oe2203sp3 |
edk2openEuler:24.03-LTS-SP1 |
before 202308-25.oe2403sp1 | 202308-25.oe2403sp1 |
edk2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 0~20150106.5c2d456b-20~20160104.c2a892d7-10~20160408.ffea0a2c-20~20160408.ffea0a2c-2ubuntu0.10~20160408.ffea0a2c-2ubuntu0.20~20160408.ffea0a2c-2ubuntu0.2+esm10~20160408.ffea0a2c-2ubuntu0.2+esm30~20160408.ffea0a2c-2ubuntu0.2+esm4 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
edk2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 0~20170911.5dfba97c-10~20171010.234dbcef-10~20171027.76fd5a66-10~20171205.a9212288-10~20180105.0bc94c74-1 Show 8 moreShow less0~20180205.c0d9813c-10~20180205.c0d9813c-20~20180205.c0d9813c-2ubuntu0.10~20180205.c0d9813c-2ubuntu0.20~20180205.c0d9813c-2ubuntu0.30~20180205.c0d9813c-2ubuntu0.3+esm10~20180205.c0d9813c-2ubuntu0.3+esm20~20180205.c0d9813c-2ubuntu0.3+esm3 |
None known |
edk2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 0~20190606.20d2e5a1-2ubuntu10~20190828.37eef910-30~20190828.37eef910-40~20191122.bd85bf54-10~20191122.bd85bf54-1ubuntu1 Show 11 moreShow less0~20191122.bd85bf54-20~20191122.bd85bf54-2ubuntu10~20191122.bd85bf54-2ubuntu20~20191122.bd85bf54-2ubuntu30~20191122.bd85bf54-2ubuntu3.10~20191122.bd85bf54-2ubuntu3.20~20191122.bd85bf54-2ubuntu3.30~20191122.bd85bf54-2ubuntu3.40~20191122.bd85bf54-2ubuntu3.50~20191122.bd85bf54-2ubuntu3.60~20191122.bd85bf54-2ubuntu3.6+esm1 |
None known |
edk2Ubuntu:22.04:LTS |
before 2022.02-3ubuntu0.22.04.4, plus listed versions 2021.08~rc0-22021.08-32021.11~rc1-12021.11-12021.11-2 Show 8 moreShow less2022.02~rc1-12022.02~rc1-1ubuntu12022.02-12022.02-22022.02-32022.02-3ubuntu0.22.04.12022.02-3ubuntu0.22.04.22022.02-3ubuntu0.22.04.3 |
2022.02-3ubuntu0.22.04.4 |
edk2Ubuntu:24.04:LTS |
before 2024.02-2ubuntu0.6, plus listed versions 2023.05-22023.11-22023.11-32023.11-42023.11-5 Show 8 moreShow less2023.11-62023.11-82024.02-12024.02-22024.02-2ubuntu0.12024.02-2ubuntu0.32024.02-2ubuntu0.42024.02-2ubuntu0.5 |
2024.02-2ubuntu0.6 |
edk2Ubuntu:25.10 |
before 2025.02-8ubuntu3, plus listed versions 2025.02-3ubuntu22025.02-82025.02-8ubuntu12025.02-8ubuntu2 |
2025.02-8ubuntu3 |
edk2Ubuntu:26.04:LTS |
before 2025.02-8ubuntu3 | 2025.02-8ubuntu3 |
ovmfopenSUSE:Tumbleweed |
before 202505-2.1 | 202505-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-38805 is a medium vulnerability (CVSS 6.3) in Tianocore Edk2, published July 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in edk2 2025.02-8+deb13u1.
References
github.com/tianocore/edk2/security/advisories/GHSA-p7wp-52j7-6r5x
nvd.nist.gov/vuln/detail/CVE-2024-38805
security-tracker.debian.org/tracker/CVE-2024-38805
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2298
Show 39 moreShow less
ubuntu.com/security/CVE-2024-38805
cve.org/CVERecord?id=CVE-2024-38805
suse.com/security/cve/CVE-2024-38797
Left out here: 10 versions. The JSON record has them.