CVE-2024-38805: iSCSI Remote Memory Corruption and Denial of Service
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2025.02-8+deb13u1 - Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2025.02-9 - Upgrade
Upgrade
debian/edk2to a version that resolves this vulnerability.Fixed in 2025.02-8+deb13u1Fixed in 2026.08+ds-2
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is reachable over the network and requires low privileges. No user interaction is required.
What is the expected impact of successful exploitation?
Successful exploitation may cause an integer overflow or wraparound in the BIOS iSCSI functionality, leading to memory corruption and denial of service. The provided impact vector indicates high availability impact and low integrity impact, with no confidentiality impact.