Log in Start free

Vulnerability · Published May 30, 2024 · Assigned by TianoCore

CVE-2024-1298Integer Overflow caused by divide by zero during S3 suspension

Medium 6.0

In plain English

A medium-severity security flaw in edk2 from TianoCore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.0Medium
Exploit odds (30 days)0.2%top 87.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8edk2-aarch6420220126gitbb1bba3d77-13.el8_10.2ALSA-2024:5297
AlmaLinux:9edk2-aarch6420240524-6.el9_5ALSA-2024:9088
AlmaLinux:8edk2-ovmf20220126gitbb1bba3d77-13.el8_10.2ALSA-2024:5297
AlmaLinux:9edk2-ovmf20240524-6.el9_5ALSA-2024:9088
AlmaLinux:9edk2-tools20240524-6.el9_5ALSA-2024:9088
AlmaLinux:9edk2-tools-doc20240524-6.el9_5ALSA-2024:9088
Debian:12edk22022.11-6+deb12u2DEBIAN-CVE-2024-1298
Debian:13edk22024.05-1DEBIAN-CVE-2024-1298
Debian:14edk22024.05-1DEBIAN-CVE-2024-1298
Rocky Linux:8edk20:20220126gitbb1bba3d77-13.el8_10.2RLSA-2024:5297
Rocky Linux:9edk20:20240524-6.el9_5.3RLSA-2024:9088
Ubuntu:22.04:LTSedk22022.02-3ubuntu0.22.04.4USN-7894-1
Ubuntu:22.04:LTSedk22022.02-3ubuntu0.22.04.4UBUNTU-CVE-2024-1298
Ubuntu:24.04:LTSedk22024.02-2ubuntu0.6USN-7894-1
Ubuntu:24.04:LTSedk22024.02-2ubuntu0.6UBUNTU-CVE-2024-1298

Affected products (as reported)

VendorProductVersions
TianoCore edk2 0 – before edk2-stable202405

Weakness: CWE-369 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

References