CVE-2022-36765

EDK2 es susceptible a una vulnerabilidad en la función CreateHob(), lo que permite a un usuario activar un desbordamiento de enteros para desbordar el búfer a través de una red local. La explotación exitosa de esta vulnerabilidad puede resultar en un compromiso de confidencialidad, integridad y/o disponibilidad.

A flaw was found in the CreateHob() function in EDK2. An attacker, leveraging a local network, can initiate an integer overflow leading to a buffer overflow. This issue arises during size alignment within the CreateHob() function, requiring activation in the PEI phase. Successful exploitation of this flaw poses a moderate threat to confidentiality and integrity, however, the primary consequence is likely a crash or denial of service.

Marc Beatove discovered buffer overflows exit in EDK2. An attacker on the local network could potentially use this to impact availability or possibly cause remote code execution. It was discovered that a buffer overflows exists in EDK2's Network Package An attacker on the local network could potentially use these to impact availability or possibly cause remote code execution.