CVE-2024-38796: Integer overflow in PeCoffLoaderRelocateImage
EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.
Other sources
Integer overflow in PeCoffLoaderRelocateImage
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2022.11-6+deb12u2 - Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2024.08-3 - Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2022.11-6+deb12u2Fixed in 2025.02-8+deb13u1Fixed in 2026.08+ds-2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38796?
The severity of CVE-2024-38796 is critical due to the potential for memory corruption and loss of confidentiality, integrity, and availability.
How do I fix CVE-2024-38796?
To fix CVE-2024-38796, you should apply the latest patches or updates provided by your software vendor that address this vulnerability.
What software is affected by CVE-2024-38796?
CVE-2024-38796 affects the EDK2 project and its implementations.
What type of attack does CVE-2024-38796 facilitate?
CVE-2024-38796 facilitates memory corruption attacks that can be exploited via an adjacent network.
What are the potential impacts of exploiting CVE-2024-38796?
Exploiting CVE-2024-38796 may lead to significant impacts including loss of confidentiality, integrity, and availability of the affected systems.