{"id":"CVE-2024-38797","aliases":["DEBIAN-CVE-2024-38797","EUVD-2024-54393","GHSA-4wjw-6xmf-44xf","OESA-2025-1503","UBUNTU-CVE-2024-38797","USN-7894-1","openSUSE-SU-2025:15255-1"],"status":"published","title":"Out-of-bounds Read in HashPeImageByType()","description":"EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00218,"percentile":0.12393,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2025-04-07T17:18:01Z","modified":"2026-11-02T12:02:36Z","fixes":[{"ecosystem":"Debian:13","package":"edk2","fixed_in":["2025.02-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["2025.02-8"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"edk2","fixed_in":["202308-22.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","fixed_in":["202308-22.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","fixed_in":["202002-30.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"edk2","fixed_in":["202011-27.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"edk2","fixed_in":["202011-26.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"edk2","fixed_in":["2022.02-3ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"edk2","fixed_in":["2024.02-2ubuntu0.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.11-6","2022.11-6+deb12u1","2022.11-6+deb12u2","2023.02-1","2023.02-2","2023.05-1","2023.05-2","2023.08-1","2023.11-1","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-7","2023.11-8","2024.02-1","2024.02-2","2024.05-1","2024.05-2","2024.08-1","2024.08-2","2024.08-3","2024.08-4","2024.11-1","2024.11-2","2024.11-3","2024.11-4","2024.11-5","2025.02-1","2025.02-10","2025.02-2","2025.02-3","2025.02-4","2025.02-5","2025.02-6","2025.02-7","2025.02-8","2025.02-9","2025.05-1","2025.05-2","2025.08.01-1","2025.08.01-2","2025.08.01-3","2025.08.01-4","2025.08.01-5","2025.08.01-6","2025.11-1","2025.11-2","2025.11-3","2025.11-4","2025.11-5","2026.02-1","2026.02-2","2026.02-3","2026.05-1","2026.05-2","2026.05-3","2026.08+ds-1","2026.08+ds-2"]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.02-8"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.02-8"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-22.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-22.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-30.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-27.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-26.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1","0~20160408.ffea0a2c-2ubuntu0.2+esm3","0~20160408.ffea0a2c-2ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1","0~20180205.c0d9813c-2ubuntu0.3+esm2","0~20180205.c0d9813c-2ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5","0~20191122.bd85bf54-2ubuntu3.6","0~20191122.bd85bf54-2ubuntu3.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.4"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.02-2ubuntu0.6"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.4"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.02-2ubuntu0.6"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5"],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202505-2.1"}]}],"bundled":2}],"products":[{"vendor":"tianocore","product":"edk2"}],"references":[{"url":"https://github.com/tianocore/edk2/security/advisories/GHSA-4wjw-6xmf-44xf","tags":["advisory","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-38797","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38797","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-38797","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38797","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7894-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-2650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-5678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-6237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-0727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-2511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-5535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-9143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-13176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-9232","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38805","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-38797","title":"Out-of-bounds Read in HashPeImageByType()","description":"EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.","status":"published","published":"2025-04-07T17:18:01.014Z","modified":"2025-04-08T16:00:53.582Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:16.367792Z"}],"euvd":[{"id":"EUVD-2024-54393","description":"EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.","status":"published","published":"2025-04-07T17:18:01Z","modified":"2025-04-08T16:00:53Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:39.54776Z"}],"nvd":[{"id":"CVE-2024-38797","description":"EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.","status":"published","published":"2025-04-07T18:15:45.337Z","modified":"2026-06-17T07:41:04.603Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"CVE-2024-38797","description":"EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.","status":"published","published":"2025-04-07T18:15:45.337Z","modified":"2026-04-10T05:13:30.377492Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"DEBIAN-CVE-2024-38797","description":"EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.","status":"published","published":"2025-04-07T18:15:45.337Z","modified":"2026-11-02T12:02:36.686972506Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"OESA-2025-1503","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nEDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.(CVE-2024-38797)","status":"published","published":"2025-05-09T11:08:35Z","modified":"2026-08-18T01:17:57.93710887Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2024-38797","description":"EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.","status":"published","published":"2025-04-07T18:15:00Z","modified":"2026-10-05T19:21:00.989021868Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"openSUSE-SU-2025:15255-1","title":"ovmf-202505-2.1 on GA media","description":"These are all security issues fixed in the ovmf-202505-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:33.370589Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"USN-7894-1","title":"edk2 vulnerabilities","description":"It was discovered that EDK II was susceptible to a predictable TCP Initial\nSequence Number. An attacker could possibly use this issue to gain\nunauthorized access. This issue only affected Ubuntu 22.04 LTS, and Ubuntu\n24.04 LTS. (CVE-2023-45236, CVE-2023-45237)\n\nIt was discovered that EDK II incorrectly handled S3 sleep. An attacker\ncould possibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-1298)\n\nIt was discovered that the EDK II PE/COFF loader incorrectly handled\ncertain memory operations. An attacker could possibly use this issue to\ncause a denial of service, obtain sensitive information, or execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu\n24.04 LTS. (CVE-2024-38796)\n\nIt was discovered that the EDK II PE image hashing function incorrectly\nhandled certain memory operations. An attacker could possibly use this\nissue to cause a denial of service, or execute arbitrary code.\n(CVE-2024-38797)\n\nIt was discovered that the EDK II BIOS incorrectly handled certain memory\noperations. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2024-38805, CVE-2025-2295)\n\nIt was discovered that EDK II incorrectly handled the enabling of MCE. An\nattacker could possibly use this issue to cause a denial of service, or\nexecute arbitrary code. (CVE-2025-3770)\n\nIt was discovered that the OpenSSL library embedded in EDK II contained\nmultiple vulnerabilties. An attacker could possibly use these issues to\ncause a denial of service, obtain sensitive information, or execute\narbitrary code. (CVE-2021-3712, CVE-2022-0778, CVE-2022-4304,\nCVE-2022-4450, CVE-2023-0215, CVE-2023-0286, CVE-2023-0464, CVE-2023-0465,\nCVE-2023-0466, CVE-2023-2650, CVE-2023-3446, CVE-2023-3817, CVE-2023-5678,\nCVE-2023-6237, CVE-2024-0727, CVE-2024-13176, CVE-2024-2511,\nCVE-2024-41996, CVE-2024-4741, CVE-2024-5535, CVE-2024-6119, CVE-2024-9143,\nCVE-2025-9232)","status":"published","published":"2025-11-26T15:05:43Z","modified":"2026-11-09T12:46:35.954753636Z","updated_at":"2026-11-09T12:55:09.79476Z"}]}}