
Cloud Vulnerability DB
A community-led vulnerabilities database
EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage() function identified as CVE-2024-38796. The vulnerability was discovered and reported through TianoCore's bug tracking system and was publicly disclosed on September 27, 2024. The flaw affects EDK2 versions through 202408, which is used in UEFI firmware for Virtual Machines (TianoCore Advisory).
The vulnerability is classified as a heap-based buffer overflow (CWE-122) in the PeCoffLoaderRelocateImage() function within BasePeCoff.c. The issue occurs due to integer overflows when checking RelocDir→VirtualAddress + ReloDir→Size - 1 inside a function call. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L (TianoCore Advisory, NVD).
A successful exploitation of this vulnerability can lead to memory corruption, potentially resulting in loss of Confidentiality, Integrity, and Availability. The impact includes possible disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS) (NetApp Advisory).
Patch files are available through the TianoCore bug tracking system at https://bugzilla.tianocore.org/show_bug.cgi?id=1993. The patch is planned to be integrated into a future 2024 EDK2 release. Red Hat has released security updates for affected versions in RHEL 8 and RHEL 9 (Red Hat Advisory, Red Hat Advisory).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."