Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-2295
CVE-2025-2295:
Linux Debian vulnerability analysis and mitigation
Overview
EDK2 contains a vulnerability in BIOS (CVE-2025-2295) discovered on March 14, 2025, where a user may cause an Integer Overflow or Wraparound by network means. The vulnerability affects the iSCSI DXE component in EDK2's NetworkPkg (NVD, GitHub Advisory).
Technical details
The vulnerability exists in the NetworkPkg/IScsiDxe component where a malicious iSCSI target can trigger an integer overflow through specially crafted R2T (Ready To Transfer) messages. The issue occurs in the IScsiOnR2TRcvd function when processing R2T PDUs, where the BufferOffset and DesiredDataTransferLength values from the R2T header can cause an integer overflow, bypassing input validation. The CVSS v3.1 base score is 3.5 (LOW) with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L (GitHub Advisory).
Impact
When successfully exploited, this vulnerability can lead to remote memory exposure where out-of-bounds memory contents can be copied into response PDUs and transmitted to the iSCSI target, resulting in potential information disclosure and denial of service (GitHub Advisory).
Mitigation and workarounds
The vulnerability affects EDK2 versions up to and including 202502. As of the advisory publication, no patched versions have been released (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management