From d79d8d6a8dc3b7324b167031c89400390261acf3 Mon Sep 17 00:00:00 2001 From: Doug Flick Date: Mon, 7 Apr 2025 11:23:41 -0700 Subject: [PATCH] SecurityPkg: Update SecurityFixes.yaml for CVE-2024-38797 This commit updates the SecurityFixes.yaml file to include information about the CVE-2024-38797 vulnerability. Signed-off-by: Doug Flick --- SecurityPkg/SecurityFixes.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/SecurityPkg/SecurityFixes.yaml b/SecurityPkg/SecurityFixes.yaml index b4006b42b8..06b597a43e 100644 --- a/SecurityPkg/SecurityFixes.yaml +++ b/SecurityPkg/SecurityFixes.yaml @@ -40,3 +40,18 @@ CVE_2022_36764: - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c links: - https://bugzilla.tianocore.org/show_bug.cgi?id=4118 +CVE_2024_38797: + commit-titles: + - "SecurityPkg: Out of bound read in HashPeImageByType()" + - "SecurityPkg: Improving HashPeImageByType () logic" + - "SecurityPkg: Improving SecureBootConfigImpl:HashPeImageByType () logic" + cve: CVE-2024-38797 + date_reported: 2024-06-04 12:00 UTC + description: Out of bound read in HashPeImageByType() + note: + files_impacted: + - SecurityPkg\Library\DxeImageVerificationLib\DxeImageVerificationLib.c + - SecurityPkg\VariableAuthenticated\SecureBootConfigDxe\SecureBootConfigImpl.c + links: + - https://bugzilla.tianocore.org/show_bug.cgi?id=2214 + - https://github.com/tianocore/edk2/security/advisories/GHSA-4wjw-6xmf-44xf