Moderate Security Update for edk2 Packages: Out-of-Bounds Read & Write Vulnerability
Summary
ALSA-2026:2776: Moderate: edk2 security update. Affects edk2-aarch64 versions < 20241117-4.el9_7.3. Fixed in 20241117-4.el9_7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The EDK (Embedded Development Kit) is a project aimed at enabling UEFI (Unified Extensible Firmware Interface) support for virtual machines. It includes essential packages such as edk2-aarch64, edk2-ovmf, edk2-tools, and edk2-tools-doc, which provide sample 64-bit UEFI firmware for QEMU and KVM. These packages are critical for developers working with virtualized environments, but they are susceptible to security vulnerabilities that can compromise system integrity.
Vulnerability Detail
The vulnerability identified as CVE-2025-9230 involves an out-of-bounds read and write in the RFC 3211 KEK Unwrap process within the OpenSSL library. This flaw can potentially allow an attacker to exploit the affected packages, leading to unauthorized access or manipulation of sensitive data. The risk is particularly significant in environments where UEFI firmware is utilized, as it could lead to severe security breaches.
How To Fix
Minimum fixed version
20241117-4.el9_7.3
This is the first release that contains the fix.
sudo dnf update edk2-aarch64Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the use of the affected UEFI firmware until the packages can be updated. This may involve configuring your virtual machine settings to use a different firmware option.
Conclusion
The edk2 packages are critical for UEFI support in virtualized environments but are currently affected by a moderate security vulnerability (CVE-2025-9230). It is crucial to update to the patched version to ensure system security and integrity. Utilize tools like Vulert for ongoing monitoring of vulnerabilities in your software.
See every vulnerability recorded for edk2-aarch64 →
FAQ
CVE-2025-9230 is a security vulnerability related to an out-of-bounds read and write in the RFC 3211 KEK Unwrap process in OpenSSL, affecting the edk2 packages.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data and potential manipulation of the system, posing a significant security risk.
Yes, a patch is available. Update the affected packages to version 20241117-4.el9_7.3 to mitigate the vulnerability.
If immediate updating is not possible, consider disabling the use of the affected UEFI firmware as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for edk2-aarch64.
