CVE catalog

CVE-2024-38796

EDK II vulnerabilities

Severity: Medium · CVSS 5.9CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
Published: Sep 27, 2024, 10:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.37% · Oct 25, 2026

A flaw was found in the EDK2 package. This flaw allows an attacker to cause memory corruption due to an overflow via an adjacent network. This issue may lead to loss of confidentiality, integrity, and availability. edk2: Integer overflows in PeCoffLoaderRelocateImage The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	edk2	sid	`2026.08+ds-2`	fixed
Debian	edk2	forky	`2026.08+ds-2`	fixed
Debian	edk2	trixie	`2025.02-8+deb13u1`	fixed
Debian	edk2	bookworm	`2022.11-6+deb12u2`	fixed
Debian	edk2	bookworm-security	`2022.11-6+deb12u1`	vulnerable
Ubuntu	edk2	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	efi-shell-aa64	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	efi-shell-arm	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	efi-shell-ia32	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	efi-shell-riscv64	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	efi-shell-x64	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	ovmf	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	ovmf-ia32	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	qemu-efi-aarch64	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	qemu-efi-arm	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	qemu-efi-riscv64	noble	`2024.02-2ubuntu0.6`	fixed
Ubuntu	edk2	pro	`0~20190606.20d2e5a1-2ubuntu1`	vulnerable
Ubuntu	edk2	pro	`0~20190828.37eef910-3`	vulnerable
Ubuntu	edk2	pro	`0~20190828.37eef910-4`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-1ubuntu1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu2`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.2`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.3`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.4`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.5`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.6`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.6+esm1`	vulnerable
Ubuntu	edk2	22.04	`2021.08~rc0-2`	vulnerable
Ubuntu	edk2	22.04	`2021.08-3`	vulnerable
Ubuntu	edk2	22.04	`2021.11~rc1-1`	vulnerable
Ubuntu	edk2	22.04	`2021.11-1`	vulnerable
Ubuntu	edk2	22.04	`2021.11-2`	vulnerable
Ubuntu	edk2	22.04	`2022.02~rc1-1`	vulnerable
Ubuntu	edk2	22.04	`2022.02~rc1-1ubuntu1`	vulnerable
Ubuntu	edk2	22.04	`2022.02-1`	vulnerable
Ubuntu	edk2	22.04	`2022.02-2`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.1`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.2`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.3`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.4`	fixed
Ubuntu	edk2	24.04	`2023.05-2`	vulnerable
Ubuntu	edk2	24.04	`2023.11-2`	vulnerable
Ubuntu	edk2	24.04	`2023.11-3`	vulnerable
Ubuntu	edk2	24.04	`2023.11-4`	vulnerable
Ubuntu	edk2	24.04	`2023.11-5`	vulnerable
Ubuntu	edk2	24.04	`2023.11-6`	vulnerable
Ubuntu	edk2	24.04	`2023.11-8`	vulnerable
Ubuntu	edk2	24.04	`2024.02-1`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.1`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.3`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.4`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.5`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.6`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	edk2	source	sid	`2024.08-3`	not yet assigned	Not reported	[1084055]
Debian	edk2	source	forky	`2024.08-3`	not yet assigned	Not reported	[1084055]
Debian	edk2	source	trixie	`2024.08-3`	not yet assigned	Not reported	[1084055]
Debian	edk2	source	bookworm	`2022.11-6+deb12u2`	not yet assigned	Not reported	[1084055]
Ubuntu	edk2	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	efi-shell-aa64	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	efi-shell-arm	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	efi-shell-ia32	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	efi-shell-riscv64	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	efi-shell-x64	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	ovmf	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	ovmf-ia32	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	qemu-efi-aarch64	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	qemu-efi-arm	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	qemu-efi-riscv64	deb	noble	`2024.02-2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	edk2	deb	22.04	`2022.02-3ubuntu0.22.04.4`	Not reported	UBUNTU-CVE-2024-38796	Not reported
Ubuntu	edk2	deb	24.04	`2024.02-2ubuntu0.6`	Not reported	UBUNTU-CVE-2024-38796	Not reported

[Debian bug #1084055]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[ovmf]Affected
Source package: [edk2]
Details (4)
- 2022.11-6+deb12u2 · all · bookworm
  Fixed · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u2 · all · bookworm
  Fixed · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u1 · all · bookworm-security
  Affected · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u1 · all · bookworm-security
  Affected · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
[ovmf-ia32]Affected
Source package: [edk2]
Details (4)
- 2022.11-6+deb12u2 · all · bookworm
  Fixed · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u2 · all · bookworm
  Fixed · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u1 · all · bookworm-security
  Affected · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u1 · all · bookworm-security
  Affected · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
[qemu-efi]Affected
Source package: [edk2]
Details (4)
- 2022.11-6+deb12u2 · all · bookworm
  Fixed · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u2 · all · bookworm
  Fixed · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u1 · all · bookworm-security
  Affected · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u1 · all · bookworm-security
  Affected · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
[qemu-efi-aarch64]Affected
Source package: [edk2]
Details (4)
- 2022.11-6+deb12u2 · all · bookworm
  Fixed · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u2 · all · bookworm
  Fixed · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u1 · all · bookworm-security
  Affected · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u1 · all · bookworm-security
  Affected · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
[qemu-efi-arm]Affected
Source package: [edk2]
Details (4)
- 2022.11-6+deb12u2 · all · bookworm
  Fixed · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u2 · all · bookworm
  Fixed · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u1 · all · bookworm-security
  Affected · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12
- 2022.11-6+deb12u1 · all · bookworm-security
  Affected · Fixed: 2022.11-6+deb12u2
  usn · edk2 · debian · bookworm; usn · edk2 · debian · 12

[Debian 13 (Trixie)]

[efi-shell-aa64]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[efi-shell-arm]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[efi-shell-ia32]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[efi-shell-loongarch64]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[efi-shell-riscv64]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[efi-shell-x64]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[ovmf]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[ovmf-ia32]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[qemu-efi-aarch64]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[qemu-efi-arm]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[qemu-efi-loongarch64]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
[qemu-efi-riscv64]Fixed
Source package: [edk2]
Details (2)
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13
- 2025.02-8+deb13u1 · all · trixie
  Fixed · Fixed: 2024.08-3
  usn · edk2 · debian · 13

Observed: Oct 27, 2026, 1:34:51 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]