EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability.(CVE-2022-36763)

    EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability.(CVE-2022-36764)

    EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability.(CVE-2022-36765)

    EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability.(CVE-2023-45230)

    EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing  Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality.(CVE-2023-45231)

    EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability.(CVE-2023-45232)

    EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability.(CVE-2023-45233)

    EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or     Availability.(CVE-2023-45234)

    EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or     Availability.(CVE-2023-45235)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization edk2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3017 advisory.

    [20220126gitbb1bba3d77-13]
    - edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-21158]
    - edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-21158]
    - Resolves: RHEL-21158       (CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-8])

    [20220126gitbb1bba3d77-12]
    - edk2-Apply-uncrustify-changes-to-.c-.h-files-in-the-Netwo.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Apply-uncrustify-changes.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850     RHEL-21852]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848     RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Apply-uncrustify-changes-p2.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848     RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - Resolves: RHEL-21840       (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise     message [rhel-8])
    - Resolves: RHEL-21844       (CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options     [rhel-8])
    - Resolves: RHEL-21846       (CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header     [rhel-8])
    - Resolves: RHEL-21848       (CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header     [rhel-8])
    - Resolves: RHEL-21850       (CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message     [rhel-8])
    - Resolves: RHEL-21852       (CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise     message [rhel-8])

    [20220126gitbb1bba3d77-11]
    - edk2-SecurityPkg-Change-use-of-EFI_D_-to-DEBUG_.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-Change-OPTIONAL-keyword-usage-style.patch [RHEL-21154 RHEL-21156]
    - edk2-MdePkg-Introduce-CcMeasurementProtocol-for-CC-Guest-.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpm2.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpmM.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-418.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SEC-PATCH-4118-2.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-DxeTpmMeasureBootLib-SEC-PATCH-4117-2.patch [RHEL-21154 RHEL-21156]
    - edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch [RHEL-21154 RHEL-21156]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21840 RHEL-21842]
    - edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch [RHEL-21840 RHEL-21842]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21840 RHEL-21842]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch [RHEL-21840 RHEL-21842]
    - Resolves: RHEL-21154       (CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8])
    - Resolves: RHEL-21156       (CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8])
    - Resolves: RHEL-21840       (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise     message [rhel-8])
    - Resolves: RHEL-21842       (CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8])

    [20220126gitbb1bba3d77-10]
    - edk2-OvmfPkg-VirtNorFlashDxe-clone-ArmPlatformPkg-s-NOR-f.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-remove-CheckBlockLocked-feat.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-remove-disk-I-O-protocol-imp.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-drop-block-I-O-protocol-impl.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-avoid-array-mode-switch-afte.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-avoid-switching-between-mode.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-use-EFI_MEMORY_WC-and-drop-A.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariable2.patch [RHEL-17587]
    -  edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variable2.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-add-casts-to-UINTN-and-UINT3.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-clarify-block-write-logic-fi.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-add-a-loop-for-NorFlashWrite.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-allow-larger-writes-without-.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-ValidateFvHeader-unwritten-s.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-move-DoErase-code-block-into.patch [RHEL-17587]
    - edk2-ArmVirtPkg-ArmVirtQemu-migrate-to-OVMF-s-VirtNorFlas.patch [RHEL-17587]
    - edk2-OvmfPkg-clone-NorFlashPlatformLib-into-VirtNorFlashP.patch [RHEL-17587]
    - Resolves: RHEL-17587       ([rhel8] guest fails to boot due to ASSERT error)

    [20220126gitbb1bba3d77-9]
    - edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariableG.patch [RHEL-17587]
    - edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variables.patch [RHEL-17587]
    - Resolves: RHEL-17587       ([rhel8] guest fails to boot due to ASSERT error)

    [20220126gitbb1bba3d77-8]
    - edk2-Bumped-openssl-submodule-version-to-cf317b2bb227.patch [RHEL-7560]
    - Resolves: RHEL-7560       (CVE-2023-3446 edk2: openssl: Excessive time spent checking DH keys and parameters [rhel-8])

    [20220126gitbb1bba3d77-7]
    - edk2-add-8.6-machine-type-to-edk2-ovmf-cc.json.patch [RHEL-12626]
    - Resolves: RHEL-12626       (Missing firmware descriptor with secureboot disabled in RHEL 8)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3017 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message     (CVE-2023-45235)

    * EDK2: heap buffer overflow in Tcg2MeasureGptTable() (CVE-2022-36763)

    * EDK2: heap buffer overflow in Tcg2MeasurePeImage() (CVE-2022-36764)

    * EDK2: integer overflow in CreateHob() could lead to HOB OOB R/W (CVE-2022-36765)

    * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message     (CVE-2023-45229)

    * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231)

    * edk2: Infinite loop when parsing unknown options in the Destination Options header (CVE-2023-45232)

    * edk2: Infinite loop when parsing a PadN option in the Destination Options header (CVE-2023-45233)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3017 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:2264 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
    Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key     or DH parameters may experience long delays. Where the key or parameters that are being checked have been     obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs     various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too     large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is     over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or     parameters that have been supplied. Some of those checks use the supplied modulus value even if it has     already been found to be too large. An application that calls DH_check() and supplies a key or parameters     obtained from an untrusted source could be vulernable to a Denial of Service attack. The function     DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those     other functions may similarly be affected. The other functions affected by this are DH_check_ex() and     EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications     when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The     OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. (CVE-2023-3446)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2264 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
    Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key     or DH parameters may experience long delays. Where the key or parameters that are being checked have been     obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs     various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too     large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is     over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or     parameters that have been supplied. Some of those checks use the supplied modulus value even if it has     already been found to be too large. An application that calls DH_check() and supplies a key or parameters     obtained from an untrusted source could be vulernable to a Denial of Service attack. The function     DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those     other functions may similarly be affected. The other functions affected by this are DH_check_ex() and     EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications     when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The     OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. (CVE-2023-3446)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2264 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
    Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key     or DH parameters may experience long delays. Where the key or parameters that are being checked have been     obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs     various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too     large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is     over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or     parameters that have been supplied. Some of those checks use the supplied modulus value even if it has     already been found to be too large. An application that calls DH_check() and supplies a key or parameters     obtained from an untrusted source could be vulernable to a Denial of Service attack. The function     DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those     other functions may similarly be affected. The other functions affected by this are DH_check_ex() and     EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications     when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The     OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. (CVE-2023-3446)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12343 advisory.

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45230)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-20865 advisory.

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45230)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a9dead34c5 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

  - An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories     containing LF character results in 500 errors when viewing the commit. (CVE-2023-4522)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45230)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2465 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5624 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45230)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

  - An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-     resident attacker to bypass Secure Boot. (CVE-2023-48733)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6638-1 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45230)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

  - An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-     resident attacker to bypass Secure Boot. (CVE-2023-48733)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198090	EulerOS Virtualization 2.11.0 : edk2 (EulerOS-SA-2024-1733)	Nessus	Huawei Local Security Checks	high
198086	EulerOS Virtualization 2.11.1 : edk2 (EulerOS-SA-2024-1722)	Nessus	Huawei Local Security Checks	high
198013	Oracle Linux 8 : edk2 (ELSA-2024-3017)	Nessus	Oracle Linux Local Security Checks	high
197746	RHEL 8 : edk2 (RHSA-2024:3017)	Nessus	Red Hat Local Security Checks	high
197674	CentOS 8 : edk2 (CESA-2024:3017)	Nessus	CentOS Local Security Checks	high
196955	Rocky Linux 9 : edk2 (RLSA-2024:2264)	Nessus	Rocky Linux Local Security Checks	high
195049	Oracle Linux 9 : edk2 (ELSA-2024-2264)	Nessus	Oracle Linux Local Security Checks	high
194810	RHEL 9 : edk2 (RHSA-2024:2264)	Nessus	Red Hat Local Security Checks	high
193858	Oracle Linux 8 : edk2 (ELSA-2024-12343)	Nessus	Oracle Linux Local Security Checks	high
193857	Oracle Linux 8 : edk2 (ELSA-2024-20865)	Nessus	Oracle Linux Local Security Checks	high
193610	EulerOS Virtualization 2.10.0 : edk2 (EulerOS-SA-2024-1541)	Nessus	Huawei Local Security Checks	high
193609	EulerOS Virtualization 2.10.1 : edk2 (EulerOS-SA-2024-1560)	Nessus	Huawei Local Security Checks	high
191955	Fedora 39 : edk2 (2024-a9dead34c5)	Nessus	Fedora Local Security Checks	high
190699	Amazon Linux 2 : edk2 (ALAS-2024-2465)	Nessus	Amazon Linux Local Security Checks	high
190574	Debian dsa-5624 : ovmf - security update	Nessus	Debian Local Security Checks	high
190562	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : EDK II vulnerabilities (USN-6638-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2022-36763

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high