{"id":"CVE-2024-1298","aliases":["ALSA-2024:5297","ALSA-2024:9088","AZL-42336","AZL-42337","AZL-42346","BELL-CVE-2024-1298","CLSA-2026-1779785882","DEBIAN-CVE-2024-1298","DLA-4207-1","EUVD-2024-17059","GHSA-xvcj-qw55-xx42","OESA-2024-1752","RHSA-2024:4747","RHSA-2024:5297","RHSA-2024:5623","RHSA-2024:9088","RLSA-2024:5297","RLSA-2024:9088","SUSE-SU-2024:4088-1","SUSE-SU-2024:4357-1","SUSE-SU-2025:02516-1","SUSE-SU-2025:0503-1","UBUNTU-CVE-2024-1298","USN-7894-1"],"status":"published","title":"Integer Overflow caused by divide by zero during S3 suspension","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","severity":{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00219,"percentile":0.12492,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-369"],"published":"2024-05-30T20:46:21Z","modified":"2026-11-02T12:00:27Z","fixes":[{"ecosystem":"Azure Linux:3","package":"edk2","fixed_in":["20240524git3e722403cd16-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"hvloader","fixed_in":["1.0.1-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"edk2","fixed_in":["20230301gitf80f052277c8-39"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"edk2","fixed_in":["2022.11-6+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"edk2","fixed_in":["2024.05-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["2024.05-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","fixed_in":["202002-22.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"edk2","fixed_in":["202011-18.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"edk2","fixed_in":["202011-18.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"edk2","fixed_in":["202308-8.oe2403"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-4.el8_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2-aarch64","fixed_in":["0:20220126gitbb1bba3d77-4.el8_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-4.el8_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2-aarch64","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"ovmf","fixed_in":["202208-150500.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"ovmf","fixed_in":["202208-150500.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"ovmf","fixed_in":["202208-150500.6.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.5","package":"ovmf","fixed_in":["202208-150500.6.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"ovmf","fixed_in":["202208-150500.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ovmf","fixed_in":["202008-150300.10.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ovmf","fixed_in":["202008-150300.10.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ovmf","fixed_in":["202308-150600.5.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"ovmf","fixed_in":["202308-150600.5.19.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"ovmf","fixed_in":["202308-150600.5.19.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"edk2","fixed_in":["2022.02-3ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"edk2","fixed_in":["2024.02-2ubuntu0.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220126gitbb1bba3d77-13.el8_10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220126gitbb1bba3d77-13.el8_10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524git3e722403cd16-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"hvloader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230301gitf80f052277c8-39"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.202208-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.202302-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20221207gitfff6d81270b5-9.el9_2.tuxcare.els4"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20221207gitfff6d81270b5-9.el9_2.tuxcare.els4"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20221207gitfff6d81270b5-9.el9_2.tuxcare.els4"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20221207gitfff6d81270b5-9.el9_2.tuxcare.els4"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.11-6+deb12u2"}]}],"versions":["2022.11-6","2022.11-6+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.05-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.05-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-2+deb11u3"}]}],"versions":["2020.11-2","2020.11-2+deb11u1","2020.11-2+deb11u2"],"bundled":16},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-22.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-18.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-18.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-8.oe2403"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-4.el8_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-4.el8_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-4.el8_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-13.el8_10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-13.el8_10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-13.el8_10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-13.el8_10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202208-150500.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202208-150500.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202208-150500.6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202208-150500.6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202208-150500.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-150600.5.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-150600.5.19.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-150600.5.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.15.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.15.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.15.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.15.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.15.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.15.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.15.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.15.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1","0~20160408.ffea0a2c-2ubuntu0.2+esm3","0~20160408.ffea0a2c-2ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1","0~20180205.c0d9813c-2ubuntu0.3+esm2","0~20180205.c0d9813c-2ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5","0~20191122.bd85bf54-2ubuntu3.6","0~20191122.bd85bf54-2ubuntu3.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.4"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.02-2ubuntu0.6"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.4"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.02-2ubuntu0.6"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5"],"bundled":30}],"products":[{"vendor":"tianocore","product":"edk2"}],"references":[{"url":"https://github.com/tianocore/edk2/security/advisories/GHSA-chfw-xj8f-6m53","tags":["x_transferred","advisory","article","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7NUL7NSZQ76A5OKDUCODQNY7WSX4SST/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIMEZWDKEIQKU7NMHKL57DOCITPGEXYN/","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0002/","tags":["advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1298","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7NUL7NSZQ76A5OKDUCODQNY7WSX4SST"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIMEZWDKEIQKU7NMHKL57DOCITPGEXYN"},{"url":"https://security.netapp.com/advisory/ntap-20250306-0002"},{"url":"https://github.com/advisories/GHSA-xvcj-qw55-xx42"},{"url":"https://access.redhat.com/errata/RHSA-2024:5297","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45236","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45237","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1298","tags":["report"]},{"url":"https://bugzilla.redhat.com/2258703","tags":["report"]},{"url":"https://bugzilla.redhat.com/2258706","tags":["report"]},{"url":"https://bugzilla.redhat.com/2284243","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-5297.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6129","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6237","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-0727","tags":["report"]},{"url":"https://bugzilla.redhat.com/2257571","tags":["report"]},{"url":"https://bugzilla.redhat.com/2258502","tags":["report"]},{"url":"https://bugzilla.redhat.com/2259944","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9088.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-1298","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779785882.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-1298","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1752","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4747","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2284243","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4747.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1298","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258703","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258706","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5297.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45236","tags":["advisory"]},{"url":"https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html","tags":["article"]},{"url":"https://github.com/advisories/GHSA-fqc4-ffq5-4r98","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45237","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fxqf-p2p3-gxvr","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5623","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5623.json","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259944","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-26879","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-28751","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-32486","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-36446","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-43442","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-45899","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-56081","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-56974","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9088.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6129","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6129","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20240109.txt","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2024/01/09/1","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6237","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20240115.txt","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2024/01/15/2","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-0727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/pull/23362","tags":["article"]},{"url":"https://www.openssl.org/news/secadv/20240125.txt","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5297","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9088","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244088-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225889","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-1298","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244357-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502516-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245542","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250503-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218879","tags":["report"]},{"url":"https://bugzilla.suse.com/1218880","tags":["report"]},{"url":"https://bugzilla.suse.com/1218881","tags":["report"]},{"url":"https://bugzilla.suse.com/1218882","tags":["report"]},{"url":"https://bugzilla.suse.com/1218883","tags":["report"]},{"url":"https://bugzilla.suse.com/1218884","tags":["report"]},{"url":"https://bugzilla.suse.com/1218885","tags":["report"]},{"url":"https://bugzilla.suse.com/1218886","tags":["report"]},{"url":"https://bugzilla.suse.com/1218887","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45237","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-1298","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7894-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-2650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-5678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-6237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-0727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-2511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-5535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-9143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-13176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-9232","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-1298","title":"Integer Overflow caused by divide by zero during S3 suspension","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","status":"published","published":"2024-05-30T20:46:21.627Z","modified":"2025-11-03T19:29:13.181Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:34:18.259965Z"}],"euvd":[{"id":"EUVD-2024-17059","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","status":"published","published":"2024-05-30T20:46:21Z","modified":"2025-11-03T19:29:13Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-xvcj-qw55-xx42","title":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division...","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","status":"published","published":"2024-05-30T21:33:37Z","modified":"2025-11-03T21:31:06Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T15:04:18.722049Z"}],"nvd":[{"id":"CVE-2024-1298","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","status":"published","published":"2024-05-30T21:15:09.213Z","modified":"2026-06-17T07:03:55.353Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:10:03.465199Z"}],"osv":[{"id":"BELL-CVE-2024-1298","status":"published","published":"2024-06-03T05:56:47.583874Z","modified":"2026-01-26T09:42:49.115595Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-1298","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","status":"published","published":"2024-05-30T21:15:09.213Z","modified":"2026-03-15T22:48:20.149313Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DEBIAN-CVE-2024-1298","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","status":"published","published":"2024-05-30T21:15:09.213Z","modified":"2026-11-02T12:00:27.652173114Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-1752","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\r\n\r\nEDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.(CVE-2024-1298)","status":"published","published":"2024-06-21T11:07:13Z","modified":"2026-08-18T01:17:24.562065432Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:4747","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-09-16T20:20:54Z","modified":"2026-03-18T11:35:21.384844Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5297","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-09-16T20:21:03Z","modified":"2026-03-18T11:35:24.223505Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5623","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-09-16T20:21:12Z","modified":"2026-03-18T11:31:34.079769Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:9088","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-11-12T14:31:53Z","modified":"2026-08-09T10:05:56Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RLSA-2024:5297","title":"Moderate: edk2 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* edk2: Predictable TCP Initial Sequence Numbers (CVE-2023-45236)\n\n* edk2: Use of a Weak PseudoRandom Number Generator (CVE-2023-45237)\n\n* edk2: Temporary DoS vulnerability (CVE-2024-1298)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T20:08:44.798981Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-1298","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","status":"published","published":"2024-05-30T21:15:00Z","modified":"2026-10-05T19:20:54.096799193Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"ALSA-2024:5297","title":"Moderate: edk2 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* edk2: Predictable TCP Initial Sequence Numbers (CVE-2023-45236)\n* edk2: Use of a Weak PseudoRandom Number Generator (CVE-2023-45237)\n* edk2: Temporary DoS vulnerability (CVE-2024-1298)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-13T00:00:00Z","modified":"2026-10-29T11:02:21.594641216Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:9088","title":"Moderate: edk2 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   \n\nSecurity Fix(es):  \n\n  * mysql: openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)\n  * openssl: Excessive time spent checking invalid RSA public keys (CVE-2023-6237)\n  * openssl: denial of service via null dereference (CVE-2024-0727)\n  * edk2: Temporary DoS vulnerability (CVE-2024-1298)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:51.443029244Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-42336","title":"CVE-2024-1298 affecting package edk2 for versions less than 20240524git3e722403cd16-1","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","status":"published","published":"2024-05-30T21:15:09Z","modified":"2026-04-21T04:56:10.983057Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42337","title":"CVE-2024-1298 affecting package hvloader for versions less than 1.0.1-3","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","status":"published","published":"2024-05-30T21:15:09Z","modified":"2026-04-21T04:29:31.714108Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42346","title":"CVE-2024-1298 affecting package edk2 for versions less than 20230301gitf80f052277c8-39","description":"EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.","status":"published","published":"2024-05-30T21:15:09Z","modified":"2026-04-21T04:29:31.495833Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CLSA-2026-1779785882","title":"edk2: Fix of 5 CVEs","description":"- CVE-2024-1298: fix potential UINT32 overflow in S3 ResumeCount that could DoS firmware on resume (EDK2)\n- CVE-2024-38796: fix integer overflow in PeCoffLoaderRelocateImage() that could lead to memory corruption (EDK2)\n- CVE-2023-2650: fix DoS in OBJ_obj2txt() when parsing OBJECT IDENTIFIERs with very large sub-identifiers (bundled OpenSSL)\n- CVE-2023-3446: fix excessive runtime in DH_check() when supplied with over-sized modulus (bundled OpenSSL)\n- CVE-2024-0727: fix NULL pointer dereference in PKCS12 ContentInfo handling that could crash applications (bundled OpenSSL)","status":"published","published":"2026-05-26T08:58:07Z","modified":"2026-10-26T09:43:14.505305004Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"DLA-4207-1","title":"edk2 - security update","status":"published","published":"2025-06-02T00:00:00Z","modified":"2026-03-09T01:21:23.402813Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"RLSA-2024:9088","title":"Moderate: edk2 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* mysql: openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)\n\n* openssl: Excessive time spent checking invalid RSA public keys (CVE-2023-6237)\n\n* openssl: denial of service via null dereference (CVE-2024-0727)\n\n* edk2: Temporary DoS vulnerability (CVE-2024-1298)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:45.510776Z","modified":"2026-02-04T17:00:05.441892Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:4088-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2024-1298: Fixed potential UINT32 overflow in S3 ResumeCount (bsc#1225889).\n","status":"published","published":"2024-11-28T07:57:13Z","modified":"2026-02-04T04:00:21.584285Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4357-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2024-1298: MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount (bsc#1225889)\n","status":"published","published":"2024-12-17T12:52:21Z","modified":"2026-02-04T02:42:52.379311Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:02516-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2024-1298: Fixed potential UINT32 overflow in S3 ResumeCount (bsc#1225889).\n\nOther fixes:\n\n- Fixed Kubevirt GPU passthrough failure (bsc#1245542)\n","status":"published","published":"2025-07-24T20:17:11Z","modified":"2026-02-04T04:34:52.116384Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:0503-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2024-1298: potential division-by-zero crash in edk2 due to UINT32 overflow in S3 ResumeCount. (bsc#1225889)\n- CVE-2023-45229: out-of-bounds read in edk2 when processing IA_NA/IA_TA options in DHCPv6 Advertise messages.\n  (bsc#1218879)\n- CVE-2023-45230: buffer overflow in the DHCPv6 client in edk2 via a long Server ID option. (bsc#1218880)\n- CVE-2023-45231: out-of-bounds read in edk2 when handling a ND Redirect message with truncated options. (bsc#1218881)\n- CVE-2023-45232: infinite loop in edk2 when parsing unknown options in the Destination Options header. (bsc#1218882)\n- CVE-2023-45233: infinite loop in edk2 when parsing PadN options in the Destination Options header. (bsc#1218883)\n- CVE-2023-45234: buffer overflow in edk2 when processing DNS Servers options in a DHCPv6 Advertise message.\n  (bsc#1218884)\n- CVE-2023-45235: buffer overflow in edk2 when handling the Server ID option in a DHCPv6 proxy Advertise message.\n  (bsc#1218885)\n- CVE-2023-45236: predictable TCP Initial Sequence Numbers in edk2 network packages. (bsc#1218886)\n- CVE-2023-45237: use of a weak pseudorandom number generator in edk2. (bsc#1218887)\n","status":"published","published":"2025-02-13T10:12:12Z","modified":"2026-02-04T04:31:38.302429Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"USN-7894-1","title":"edk2 vulnerabilities","description":"It was discovered that EDK II was susceptible to a predictable TCP Initial\nSequence Number. An attacker could possibly use this issue to gain\nunauthorized access. This issue only affected Ubuntu 22.04 LTS, and Ubuntu\n24.04 LTS. (CVE-2023-45236, CVE-2023-45237)\n\nIt was discovered that EDK II incorrectly handled S3 sleep. An attacker\ncould possibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-1298)\n\nIt was discovered that the EDK II PE/COFF loader incorrectly handled\ncertain memory operations. An attacker could possibly use this issue to\ncause a denial of service, obtain sensitive information, or execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu\n24.04 LTS. (CVE-2024-38796)\n\nIt was discovered that the EDK II PE image hashing function incorrectly\nhandled certain memory operations. An attacker could possibly use this\nissue to cause a denial of service, or execute arbitrary code.\n(CVE-2024-38797)\n\nIt was discovered that the EDK II BIOS incorrectly handled certain memory\noperations. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2024-38805, CVE-2025-2295)\n\nIt was discovered that EDK II incorrectly handled the enabling of MCE. An\nattacker could possibly use this issue to cause a denial of service, or\nexecute arbitrary code. (CVE-2025-3770)\n\nIt was discovered that the OpenSSL library embedded in EDK II contained\nmultiple vulnerabilties. An attacker could possibly use these issues to\ncause a denial of service, obtain sensitive information, or execute\narbitrary code. (CVE-2021-3712, CVE-2022-0778, CVE-2022-4304,\nCVE-2022-4450, CVE-2023-0215, CVE-2023-0286, CVE-2023-0464, CVE-2023-0465,\nCVE-2023-0466, CVE-2023-2650, CVE-2023-3446, CVE-2023-3817, CVE-2023-5678,\nCVE-2023-6237, CVE-2024-0727, CVE-2024-13176, CVE-2024-2511,\nCVE-2024-41996, CVE-2024-4741, CVE-2024-5535, CVE-2024-6119, CVE-2024-9143,\nCVE-2025-9232)","status":"published","published":"2025-11-26T15:05:43Z","modified":"2026-11-09T12:46:35.954753636Z","updated_at":"2026-11-09T12:55:09.79476Z"}]}}