CVE-2024-1298: Integer Overflow caused by divide by zero during S3 suspension
EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.
Other sources
Integer Overflow caused by divide by zero during S3 suspension
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/edk2to a version that resolves this vulnerability.Fixed in 202405 - Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2022.11-6+deb12u2 - Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2024.05-1 - Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2022.11-6+deb12u2Fixed in 2025.02-8+deb13u1Fixed in 2026.08+ds-2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1298?
CVE-2024-1298 is classified as a high severity vulnerability due to the potential for loss of Availability.
How do I fix CVE-2024-1298?
To mitigate CVE-2024-1298, update your EDK2 package to version 202405 or later.
What causes the CVE-2024-1298 vulnerability?
CVE-2024-1298 is caused by a Division-By-Zero due to a UNIT32 overflow when S3 sleep is activated.
Who is affected by CVE-2024-1298?
CVE-2024-1298 affects users of the EDK2 package version up to 202405.
Can CVE-2024-1298 be exploited remotely?
CVE-2024-1298 requires local access to exploit the vulnerability.