CVE-2024-38805 - Vulnerability Details - OpenCVE

ReportizFlow

EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Tianocore	Edk2

No data.

No data.

References

Link	Providers
https://github.com/tianocore/edk2/security/advisories/GHSA-p7wp-52j7-6r5x

History

Tue, 12 Aug 2025 20:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tianocore Tianocore edk2
Vendors & Products		Tianocore Tianocore edk2

Tue, 12 Aug 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 12 Aug 2025 14:30:00 +0000

Type	Values Removed	Values Added
Description		EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
Title		iSCSI Remote Memory Corruption and Denial of Service
Weaknesses		CWE-190
References		https://github.com/tianocore/edk2/security/advisories/GHSA-p7wp-52j7-6r5x
Metrics		cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}`

MITRE

Status: PUBLISHED

Assigner: TianoCore

Published: 2025-08-12T14:13:28.174Z

Updated: 2025-08-12T14:34:39.772Z

Reserved: 2024-06-19T17:05:09.905Z

Link: CVE-2024-38805

Vulnrichment

Updated: 2025-08-12T14:34:29.446Z

NVD

Status : Awaiting Analysis

Published: 2025-08-12T15:15:28.793

Modified: 2025-08-13T17:34:12.350

Link: CVE-2024-38805

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38805", "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c", "state": "PUBLISHED", "assignerShortName": "TianoCore", "dateReserved": "2024-06-19T17:05:09.905Z", "datePublished": "2025-08-12T14:13:28.174Z", "dateUpdated": "2025-08-12T14:34:39.772Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "NetworkPkg", "product": "EDK2", "vendor": "TianoCore", "versions": [{"lessThanOrEqual": "edk2-stable202502", "status": "affected", "version": "0", "versionType": "Custom"}]}], "datePublic": "2025-08-12T14:13:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service."}], "value": "EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "65518388-201a-4f93-8712-366d21fe8d2c", "shortName": "TianoCore", "dateUpdated": "2025-08-12T14:13:28.174Z"}, "references": [{"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-p7wp-52j7-6r5x"}], "source": {"discovery": "UNKNOWN"}, "title": "iSCSI Remote Memory Corruption and Denial of Service", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-12T14:34:25.138714Z", "id": "CVE-2024-38805", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-12T14:34:39.772Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38805", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-12T14:34:25.138714Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-12T14:34:29.446Z"}}], "cna": {"title": "iSCSI Remote Memory Corruption and Denial of Service", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TianoCore", "product": "EDK2", "versions": [{"status": "affected", "version": "0", "versionType": "Custom", "lessThanOrEqual": "edk2-stable202502"}], "packageName": "NetworkPkg", "defaultStatus": "unaffected"}], "datePublic": "2025-08-12T14:13:00.000Z", "references": [{"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-p7wp-52j7-6r5x"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.", "supportingMedia": [{"type": "text/html", "value": "EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "65518388-201a-4f93-8712-366d21fe8d2c", "shortName": "TianoCore", "dateUpdated": "2025-08-12T14:13:28.174Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38805", "state": "PUBLISHED", "dateUpdated": "2025-08-12T14:34:39.772Z", "dateReserved": "2024-06-19T17:05:09.905Z", "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c", "datePublished": "2025-08-12T14:13:28.174Z", "assignerShortName": "TianoCore"}, "dataVersion": "5.1"}