{"id":"CVE-2024-38796","aliases":["ALSA-2024:11185","ALSA-2024:11219","AZL-49710","AZL-49713","AZL-49716","CLSA-2026-1779785882","DEBIAN-CVE-2024-38796","DLA-4207-1","EUVD-2024-37812","GHSA-xpcr-7hjq-m6qm","OESA-2024-2265","RHSA-2024:10268","RHSA-2024:10272","RHSA-2024:11185","RHSA-2024:11194","RHSA-2024:11219","RHSA-2024:9921","RHSA-2024:9930","RHSA-2024:9946","RHSA-2024:9956","RLSA-2024:11185","RLSA-2024:11219","UBUNTU-CVE-2024-38796","USN-7894-1"],"status":"published","title":"Integer overflow in PeCoffLoaderRelocateImage","description":"EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0037,"percentile":0.31361,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2024-09-27T21:45:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"edk2-aarch64","fixed_in":["20220126gitbb1bba3d77-13.el8_10.4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"edk2-ovmf","fixed_in":["20220126gitbb1bba3d77-13.el8_10.4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"edk2-aarch64","fixed_in":["20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"edk2-ovmf","fixed_in":["20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"edk2-tools","fixed_in":["20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"edk2-tools-doc","fixed_in":["20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"edk2","fixed_in":["20240524git3e722403cd16-8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"hvloader","fixed_in":["1.0.1-13"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"edk2","fixed_in":["20230301gitf80f052277c8-42"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"edk2","fixed_in":["2022.11-6+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"edk2","fixed_in":["2024.08-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["2024.08-3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"edk2","fixed_in":["202011-21.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"edk2","fixed_in":["202011-22.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","fixed_in":["202002-25.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"edk2","fixed_in":["202011-21.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"edk2","fixed_in":["202308-12.oe2403"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-4.el8_8.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2-aarch64","fixed_in":["0:20220126gitbb1bba3d77-4.el8_8.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-4.el8_8.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"edk2","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"edk2-ovmf","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"edk2","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"edk2-ovmf","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"edk2","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"edk2-ovmf","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-13.el8_10.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","fixed_in":["0:20220126gitbb1bba3d77-13.el8_10.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-13.el8_10.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2-aarch64","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-2.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2","fixed_in":["0:20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2-aarch64","fixed_in":["0:20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2-ovmf","fixed_in":["0:20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-aarch64","fixed_in":["0:20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-debugsource","fixed_in":["0:20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-ovmf","fixed_in":["0:20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools","fixed_in":["0:20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools-debuginfo","fixed_in":["0:20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools-doc","fixed_in":["0:20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"edk2","fixed_in":["0:20231122-6.el9_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"edk2-aarch64","fixed_in":["0:20231122-6.el9_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"edk2-ovmf","fixed_in":["0:20231122-6.el9_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-aarch64","fixed_in":["0:20231122-6.el9_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-debugsource","fixed_in":["0:20231122-6.el9_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-ovmf","fixed_in":["0:20231122-6.el9_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-tools","fixed_in":["0:20231122-6.el9_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-tools-debuginfo","fixed_in":["0:20231122-6.el9_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-tools-doc","fixed_in":["0:20231122-6.el9_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-3.el9_0.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"edk2-aarch64","fixed_in":["0:20220126gitbb1bba3d77-3.el9_0.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-3.el9_0.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"edk2","fixed_in":["0:20190829git37eef91017ad-9.el8_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"edk2-ovmf","fixed_in":["0:20190829git37eef91017ad-9.el8_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"edk2","fixed_in":["0:20221207gitfff6d81270b5-9.el9_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"edk2-aarch64","fixed_in":["0:20221207gitfff6d81270b5-9.el9_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"edk2-ovmf","fixed_in":["0:20221207gitfff6d81270b5-9.el9_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-aarch64","fixed_in":["0:20221207gitfff6d81270b5-9.el9_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-debugsource","fixed_in":["0:20221207gitfff6d81270b5-9.el9_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-ovmf","fixed_in":["0:20221207gitfff6d81270b5-9.el9_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-tools","fixed_in":["0:20221207gitfff6d81270b5-9.el9_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-tools-debuginfo","fixed_in":["0:20221207gitfff6d81270b5-9.el9_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-tools-doc","fixed_in":["0:20221207gitfff6d81270b5-9.el9_2.5"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-13.el8_10.4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"edk2","fixed_in":["0:20240524-6.el9_5.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"edk2","fixed_in":["2022.02-3ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"edk2","fixed_in":["2024.02-2ubuntu0.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220126gitbb1bba3d77-13.el8_10.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220126gitbb1bba3d77-13.el8_10.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524git3e722403cd16-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"hvloader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230301gitf80f052277c8-42"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20221207gitfff6d81270b5-9.el9_2.tuxcare.els4"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20221207gitfff6d81270b5-9.el9_2.tuxcare.els4"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20221207gitfff6d81270b5-9.el9_2.tuxcare.els4"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20221207gitfff6d81270b5-9.el9_2.tuxcare.els4"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.11-6+deb12u2"}]}],"versions":["2022.11-6","2022.11-6+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.08-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.08-3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-2+deb11u3"}]}],"versions":["2020.11-2","2020.11-2+deb11u1","2020.11-2+deb11u2"],"bundled":16},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-21.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-22.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-25.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-21.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-12.oe2403"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-4.el8_8.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-4.el8_8.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-4.el8_8.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-13.el8_10.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-13.el8_10.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-13.el8_10.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20231122-6.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20231122-6.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20231122-6.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20231122-6.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20231122-6.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20231122-6.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20231122-6.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20231122-6.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20231122-6.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-3.el9_0.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-3.el9_0.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-3.el9_0.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190829git37eef91017ad-9.el8_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190829git37eef91017ad-9.el8_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20221207gitfff6d81270b5-9.el9_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20221207gitfff6d81270b5-9.el9_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20221207gitfff6d81270b5-9.el9_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20221207gitfff6d81270b5-9.el9_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20221207gitfff6d81270b5-9.el9_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20221207gitfff6d81270b5-9.el9_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20221207gitfff6d81270b5-9.el9_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20221207gitfff6d81270b5-9.el9_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20221207gitfff6d81270b5-9.el9_2.5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-13.el8_10.4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20240524-6.el9_5.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1","0~20160408.ffea0a2c-2ubuntu0.2+esm3","0~20160408.ffea0a2c-2ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1","0~20180205.c0d9813c-2ubuntu0.3+esm2","0~20180205.c0d9813c-2ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5","0~20191122.bd85bf54-2ubuntu3.6","0~20191122.bd85bf54-2ubuntu3.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.4"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.02-2ubuntu0.6"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.4"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.02-2ubuntu0.6"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5"],"bundled":30}],"products":[{"vendor":"tianocore","product":"edk2"}],"references":[{"url":"https://github.com/tianocore/edk2/security/advisories/GHSA-xpcr-7hjq-m6qm","tags":["advisory","article","report"]},{"url":"https://security.netapp.com/advisory/ntap-20241206-0006/","tags":["advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11185","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-38796","tags":["report"]},{"url":"https://bugzilla.redhat.com/2315390","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-11185.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11219","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-11219.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38796","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779785882.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-38796","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2265","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10268","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2315390","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10268.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38796","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10272","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10272.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11185.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11194","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11194.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-63094","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11219.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9921","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9921.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9930","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9930.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9946","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9946.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9956","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9956.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:11185","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:11219","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-38796","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7894-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-2650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-5678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-6237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-0727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-2511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-5535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-9143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-13176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-9232","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-38796","title":"Integer overflow in PeCoffLoaderRelocateImage","description":"EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.","status":"published","published":"2024-09-27T21:45:00.73Z","modified":"2025-11-03T19:30:19.044Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:34:16.367792Z"}],"euvd":[{"id":"EUVD-2024-37812","description":"EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.","status":"published","published":"2024-09-27T21:45:00Z","modified":"2025-11-03T19:30:19Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"nvd":[{"id":"CVE-2024-38796","description":"EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.","status":"published","published":"2024-09-27T22:15:13.153Z","modified":"2026-06-17T07:41:04.497Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:10:29.044588Z"}],"osv":[{"id":"CVE-2024-38796","description":"EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.","status":"published","published":"2024-09-27T22:15:13.153Z","modified":"2026-03-13T11:35:41.327139Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"DEBIAN-CVE-2024-38796","description":"EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.","status":"published","published":"2024-09-27T22:15:13.153Z","modified":"2026-11-02T12:02:43.390339865Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"OESA-2024-2265","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\r\n\r\nEDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.(CVE-2024-38796)","status":"published","published":"2024-10-18T11:07:44Z","modified":"2026-08-18T01:17:35.657591751Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2024:10268","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-11-26T08:23:29Z","modified":"2026-03-18T11:36:30.917688Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:10272","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-11-26T08:19:18Z","modified":"2026-03-18T11:36:30.071557Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11185","title":"Red Hat Security Advisory: edk2:20220126gitbb1bba3d77 security update","status":"published","published":"2024-12-18T10:06:02Z","modified":"2026-03-18T11:36:40.993725Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11194","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-12-18T10:06:04Z","modified":"2026-03-18T11:36:41.43041Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11219","title":"Red Hat Security Advisory: edk2:20240524 security update","status":"published","published":"2024-12-18T10:06:06Z","modified":"2026-06-26T12:21:21.128683149Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:9921","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-11-25T09:52:47Z","modified":"2026-06-26T12:22:23.862669426Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2024:9930","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-11-25T09:52:28Z","modified":"2026-03-18T11:36:29.385903Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2024:9946","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-11-25T09:52:50Z","modified":"2026-03-18T11:36:30.586342Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2024:9956","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-11-25T09:53:12Z","modified":"2026-06-26T12:22:23.838576015Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RLSA-2024:11185","title":"Moderate: edk2:20220126gitbb1bba3d77 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* edk2: Integer overflows in PeCoffLoaderRelocateImage (CVE-2024-38796)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-06-24T17:18:45.931997Z","modified":"2025-06-24T18:01:45.359588Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2024-38796","description":"EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.","status":"published","published":"2024-09-27T22:15:00Z","modified":"2026-10-05T19:21:00.705185822Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"ALSA-2024:11185","title":"Moderate: edk2:20220126gitbb1bba3d77 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   \n\nSecurity Fix(es):  \n\n  * edk2: Integer overflows in PeCoffLoaderRelocateImage (CVE-2024-38796)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-17T00:00:00Z","modified":"2026-10-29T11:02:26.423434695Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:11219","title":"Moderate: edk2:20240524 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   \n\nSecurity Fix(es):  \n\n  * edk2: Integer overflows in PeCoffLoaderRelocateImage (CVE-2024-38796)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-17T00:00:00Z","modified":"2026-10-29T11:32:01.035193392Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-49710","title":"CVE-2024-38796 affecting package edk2 for versions less than 20240524git3e722403cd16-8","description":"EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.","status":"published","published":"2024-09-27T22:15:13Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:20.514083Z"},{"id":"AZL-49713","title":"CVE-2024-38796 affecting package hvloader for versions less than 1.0.1-13","description":"EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.","status":"published","published":"2024-09-27T22:15:13Z","modified":"2026-04-21T04:29:59.926439Z","updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-49716","title":"CVE-2024-38796 affecting package edk2 for versions less than 20230301gitf80f052277c8-42","description":"EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.","status":"published","published":"2024-09-27T22:15:13Z","modified":"2026-04-21T04:29:59.327684Z","updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"CLSA-2026-1779785882","title":"edk2: Fix of 5 CVEs","description":"- CVE-2024-1298: fix potential UINT32 overflow in S3 ResumeCount that could DoS firmware on resume (EDK2)\n- CVE-2024-38796: fix integer overflow in PeCoffLoaderRelocateImage() that could lead to memory corruption (EDK2)\n- CVE-2023-2650: fix DoS in OBJ_obj2txt() when parsing OBJECT IDENTIFIERs with very large sub-identifiers (bundled OpenSSL)\n- CVE-2023-3446: fix excessive runtime in DH_check() when supplied with over-sized modulus (bundled OpenSSL)\n- CVE-2024-0727: fix NULL pointer dereference in PKCS12 ContentInfo handling that could crash applications (bundled OpenSSL)","status":"published","published":"2026-05-26T08:58:07Z","modified":"2026-10-26T09:43:14.505305004Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"DLA-4207-1","title":"edk2 - security update","status":"published","published":"2025-06-02T00:00:00Z","modified":"2026-03-09T01:21:23.402813Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"RLSA-2024:11219","title":"Moderate: edk2:20240524 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* edk2: Integer overflows in PeCoffLoaderRelocateImage (CVE-2024-38796)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-03-17T20:16:45.510776Z","modified":"2026-02-04T11:30:10.090942Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"USN-7894-1","title":"edk2 vulnerabilities","description":"It was discovered that EDK II was susceptible to a predictable TCP Initial\nSequence Number. An attacker could possibly use this issue to gain\nunauthorized access. This issue only affected Ubuntu 22.04 LTS, and Ubuntu\n24.04 LTS. (CVE-2023-45236, CVE-2023-45237)\n\nIt was discovered that EDK II incorrectly handled S3 sleep. An attacker\ncould possibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-1298)\n\nIt was discovered that the EDK II PE/COFF loader incorrectly handled\ncertain memory operations. An attacker could possibly use this issue to\ncause a denial of service, obtain sensitive information, or execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu\n24.04 LTS. (CVE-2024-38796)\n\nIt was discovered that the EDK II PE image hashing function incorrectly\nhandled certain memory operations. An attacker could possibly use this\nissue to cause a denial of service, or execute arbitrary code.\n(CVE-2024-38797)\n\nIt was discovered that the EDK II BIOS incorrectly handled certain memory\noperations. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2024-38805, CVE-2025-2295)\n\nIt was discovered that EDK II incorrectly handled the enabling of MCE. An\nattacker could possibly use this issue to cause a denial of service, or\nexecute arbitrary code. (CVE-2025-3770)\n\nIt was discovered that the OpenSSL library embedded in EDK II contained\nmultiple vulnerabilties. An attacker could possibly use these issues to\ncause a denial of service, obtain sensitive information, or execute\narbitrary code. (CVE-2021-3712, CVE-2022-0778, CVE-2022-4304,\nCVE-2022-4450, CVE-2023-0215, CVE-2023-0286, CVE-2023-0464, CVE-2023-0465,\nCVE-2023-0466, CVE-2023-2650, CVE-2023-3446, CVE-2023-3817, CVE-2023-5678,\nCVE-2023-6237, CVE-2024-0727, CVE-2024-13176, CVE-2024-2511,\nCVE-2024-41996, CVE-2024-4741, CVE-2024-5535, CVE-2024-6119, CVE-2024-9143,\nCVE-2025-9232)","status":"published","published":"2025-11-26T15:05:43Z","modified":"2026-11-09T12:46:35.954753636Z","updated_at":"2026-11-09T12:55:09.79476Z"}]}}