USN-6638-1: EDK II vulnerabilities
First published: Thu Feb 15 2024(Updated: )
Marc Beatove discovered buffer overflows exit in EDK2. An attacker on the local network could potentially use this to impact availability or possibly cause remote code execution. (CVE-2022-36763, CVE-2022-36764, CVE-2022-36765) It was discovered that a buffer overflows exists in EDK2's Network Package An attacker on the local network could potentially use these to impact availability or possibly cause remote code execution. (CVE-2023-45230, CVE-2023-45234, CVE-2023-45235) It was discovered that an out-of-bounds read exists in EDK2's Network Package An attacker on the local network could potentially use this to impact confidentiality. (CVE-2023-45231) It was discovered that infinite-loops exists in EDK2's Network Package An attacker on the local network could potentially use these to impact availability. (CVE-2023-45232, CVE-2023-45233) Mate Kukri discovered that an insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. An attacker could use this to bypass Secure Boot. (CVE-2023-48733)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/efi-shell-aa64 | <2023.05-2ubuntu0.1 | 2023.05-2ubuntu0.1 |
| Ubuntu Ubuntu | =23.10 | |
| All of | ||
| ubuntu/efi-shell-arm | <2023.05-2ubuntu0.1 | 2023.05-2ubuntu0.1 |
| Ubuntu Ubuntu | =23.10 | |
| All of | ||
| ubuntu/efi-shell-x64 | <2023.05-2ubuntu0.1 | 2023.05-2ubuntu0.1 |
| Ubuntu Ubuntu | =23.10 | |
| All of | ||
| ubuntu/ovmf | <2023.05-2ubuntu0.1 | 2023.05-2ubuntu0.1 |
| Ubuntu Ubuntu | =23.10 | |
| All of | ||
| ubuntu/qemu-efi-aarch64 | <2023.05-2ubuntu0.1 | 2023.05-2ubuntu0.1 |
| Ubuntu Ubuntu | =23.10 | |
| All of | ||
| ubuntu/qemu-efi-arm | <2023.05-2ubuntu0.1 | 2023.05-2ubuntu0.1 |
| Ubuntu Ubuntu | =23.10 | |
| All of | ||
| ubuntu/ovmf | <2022.02-3ubuntu0.22.04.2 | 2022.02-3ubuntu0.22.04.2 |
| Ubuntu Ubuntu | =22.04 | |
| All of | ||
| ubuntu/qemu-efi | <2022.02-3ubuntu0.22.04.2 | 2022.02-3ubuntu0.22.04.2 |
| Ubuntu Ubuntu | =22.04 | |
| All of | ||
| ubuntu/qemu-efi-aarch64 | <2022.02-3ubuntu0.22.04.2 | 2022.02-3ubuntu0.22.04.2 |
| Ubuntu Ubuntu | =22.04 | |
| All of | ||
| ubuntu/qemu-efi-arm | <2022.02-3ubuntu0.22.04.2 | 2022.02-3ubuntu0.22.04.2 |
| Ubuntu Ubuntu | =22.04 | |
| All of | ||
| ubuntu/ovmf | <0~20191122.bd85bf54-2ubuntu3.5 | 0~20191122.bd85bf54-2ubuntu3.5 |
| Ubuntu Ubuntu | =20.04 | |
| All of | ||
| ubuntu/qemu-efi | <0~20191122.bd85bf54-2ubuntu3.5 | 0~20191122.bd85bf54-2ubuntu3.5 |
| Ubuntu Ubuntu | =20.04 | |
| All of | ||
| ubuntu/qemu-efi-aarch64 | <0~20191122.bd85bf54-2ubuntu3.5 | 0~20191122.bd85bf54-2ubuntu3.5 |
| Ubuntu Ubuntu | =20.04 | |
| All of | ||
| ubuntu/qemu-efi-arm | <0~20191122.bd85bf54-2ubuntu3.5 | 0~20191122.bd85bf54-2ubuntu3.5 |
| Ubuntu Ubuntu | =20.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2023-45232
- https://ubuntu.com/security/CVE-2023-45233
- https://ubuntu.com/security/CVE-2023-48733
- https://ubuntu.com/security/CVE-2023-45230
- https://ubuntu.com/security/CVE-2022-36765
- https://ubuntu.com/security/CVE-2023-45234
- https://ubuntu.com/security/CVE-2022-36763
- https://ubuntu.com/security/CVE-2023-45235
- https://ubuntu.com/security/CVE-2022-36764
- https://ubuntu.com/security/CVE-2023-45231
- https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137
- https://launchpad.net/ubuntu/+source/edk2/2023.05-2ubuntu0.1
- https://launchpad.net/ubuntu/+source/edk2/2022.02-3ubuntu0.22.04.2
- https://launchpad.net/ubuntu/+source/edk2/0~20191122.bd85bf54-2ubuntu3.5
- https://ubuntu.com/security/notices/USN-6638-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/references
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/event
- agent/tags
- agent/trending
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/23.10
- version/ubuntu ubuntu/22.04
- version/ubuntu ubuntu/20.04