Important: edk2 security, bug fix, and enhancement update
Summary
ALSA-2023:2165: Important: edk2 security, bug fix, and enhancement update. Affects edk2-aarch64 versions < 20221207gitfff6d81270b5-9.el9_2. Fixed in 20221207gitfff6d81270b5-9.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
EDK (Embedded Development Kit) is a project that enables UEFI support for Virtual Machines. It includes a sample 64-bit UEFI firmware for QEMU and KVM. The package consists of several components, including edk2-aarch64, edk2-ovmf, edk2-tools, and edk2-tools-doc. These components are used in AlmaLinux version 9. The package is responsible for providing firmware and tools necessary for running UEFI-based virtual machines.
Vulnerability Detail
The package is affected by multiple security vulnerabilities:
-
CVE-2023-0286: A type confusion vulnerability in the X.509 GeneralName implementation of OpenSSL can be exploited to cause a denial-of-service condition or potentially execute arbitrary code.
-
CVE-2021-38578: An integer underflow vulnerability in the SmmEntryPoint function of edk2 can lead to potential SMM (System Management Mode) privilege escalation.
-
CVE-2022-4304: OpenSSL is affected by a timing attack vulnerability in the RSA Decryption implementation, which could allow an attacker to recover private keys.
-
CVE-2022-4450: A double free vulnerability in OpenSSL occurs after calling the PEM_read_bio_ex function, which could lead to a denial-of-service condition or potentially execute arbitrary code.
-
CVE-2023-0215: OpenSSL is affected by a use-after-free vulnerability following the BIO_new_NDEF function, which could lead to a denial-of-service condition or potentially execute arbitrary code.
These vulnerabilities pose a risk of unauthorized code execution, privilege escalation, and denial-of-service attacks.
How To Fix
Minimum fixed version
20221207gitfff6d81270b5-9.el9_2
This is the first release that contains the fix.
sudo dnf update edk2-aarch64Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to apply the provided fix or update the affected packages to the latest version.
Conclusion
In conclusion, the edk2 package in AlmaLinux version 9 is affected by multiple security vulnerabilities. These vulnerabilities can lead to unauthorized code execution, privilege escalation, and denial-of-service attacks. It is recommended to update the affected packages to the latest version or apply the provided fix. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for edk2-aarch64 →
FAQ
These vulnerabilities can lead to unauthorized code execution, privilege escalation, and denial-of-service attacks.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for any open-source vulnerabilities.
At the time of this advisory, there are no known exploits for these vulnerabilities. However, it is important to apply the recommended updates to mitigate the risk.
For more detailed information about these vulnerabilities, including the impact, CVSS scores, acknowledgments, and related information, refer to the CVE pages listed in the References section of the AlmaLinux Release Notes.
The AlmaLinux Release Notes can be found at the following link: link
Related vulnerabilities
Recent vulnerabilities recorded for edk2-aarch64.
