Moderate Vulnerability in edk2 Packages: Out-of-Bounds Read & Write in RFC 3211 KEK Unwrap
Summary
ALSA-2026:36721: Moderate: edk2 security, bug fix, and enhancement update. Affects edk2-aarch64 versions < 20220126gitbb1bba3d77-13.el8_10.10. Fixed in 20220126gitbb1bba3d77-13.el8_10.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
EDK (Embedded Development Kit) is a project designed to enable UEFI (Unified Extensible Firmware Interface) support for Virtual Machines. It provides a sample 64-bit UEFI firmware for QEMU and KVM, facilitating the development and testing of UEFI applications. The edk2-aarch64 and edk2-ovmf packages are essential components of this framework, allowing users to run virtual machines with UEFI firmware. However, these packages are susceptible to a security vulnerability that could lead to potential exploitation.
Vulnerability Detail
The vulnerability identified as CVE-2025-9230 involves an out-of-bounds read and write in the RFC 3211 KEK Unwrap process within the OpenSSL library used by the edk2 packages. This flaw can be exploited by attackers to manipulate memory, potentially leading to unauthorized access or execution of arbitrary code. The severity of this vulnerability is classified as moderate, indicating that while it may not be critical, it still poses a significant risk to systems utilizing the affected packages.
How To Fix
Minimum fixed version
20220126gitbb1bba3d77-13.el8_10.10
This is the first release that contains the fix.
sudo dnf update edk2-aarch64Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The edk2 packages, specifically edk2-aarch64 and edk2-ovmf, are affected by a moderate vulnerability that could allow for out-of-bounds memory operations. Users are strongly advised to update to the latest patched versions to protect their systems from potential exploitation.
See every vulnerability recorded for edk2-aarch64 →
FAQ
CVE-2025-9230 is a vulnerability in the OpenSSL library used by the edk2 packages, which allows for out-of-bounds read and write operations.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access, memory manipulation, or execution of arbitrary code, posing a risk to system integrity.
It is recommended to regularly check for updates and apply them promptly to mitigate vulnerabilities and ensure system security.
Yes, failing to update could leave your system vulnerable to attacks that exploit this and other known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for edk2-aarch64.
