CVE-2024-38797: Out-of-bounds Read in HashPeImageByType()
EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2025.02-8 - Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2025.02-8+deb13u1Fixed in 2026.08+ds-2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38797?
CVE-2024-38797 has a high severity due to potential exploitation leading to integrity and availability loss.
How do I fix CVE-2024-38797?
To fix CVE-2024-38797, update to the latest version of EDK2 where the vulnerability has been patched.
Who is affected by CVE-2024-38797?
CVE-2024-38797 affects all users of EDK2, particularly those using vulnerable versions.
What type of vulnerability is CVE-2024-38797?
CVE-2024-38797 is a read out of bounds vulnerability that occurs when processing corrupted data.
What can happen if CVE-2024-38797 is exploited?
If exploited, CVE-2024-38797 may result in loss of integrity and availability of the affected system.