Test ID:	1.3.6.1.4.1.25623.1.1.12.2024.6638.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6638-1)
Summary:	The remote host is missing an update for the 'edk2' package(s) announced via the USN-6638-1 advisory.
Description:	Summary: The remote host is missing an update for the 'edk2' package(s) announced via the USN-6638-1 advisory. Vulnerability Insight: Marc Beatove discovered buffer overflows exit in EDK2. An attacker on the local network could potentially use this to impact availability or possibly cause remote code execution. (CVE-2022-36763, CVE-2022-36764, CVE-2022-36765) It was discovered that a buffer overflows exists in EDK2's Network Package An attacker on the local network could potentially use these to impact availability or possibly cause remote code execution. (CVE-2023-45230, CVE-2023-45234, CVE-2023-45235) It was discovered that an out-of-bounds read exists in EDK2's Network Package An attacker on the local network could potentially use this to impact confidentiality. (CVE-2023-45231) It was discovered that infinite-loops exists in EDK2's Network Package An attacker on the local network could potentially use these to impact availability. (CVE-2023-45232, CVE-2023-45233) Mate Kukri discovered that an insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. An attacker could use this to bypass Secure Boot. (CVE-2023-48733) Affected Software/OS: 'edk2' package(s) on Ubuntu 20.04, Ubuntu 22.04, Ubuntu 23.10. Solution: Please install the updated package(s). CVSS Score: 8.3 CVSS Vector: AV:A/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-36763 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/ https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr Common Vulnerability Exposure (CVE) ID: CVE-2022-36764 https://github.com/tianocore/edk2/security/advisories/GHSA-4hcq-p8q8-hj8j Common Vulnerability Exposure (CVE) ID: CVE-2022-36765 https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx Common Vulnerability Exposure (CVE) ID: CVE-2023-45230 http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h http://www.openwall.com/lists/oss-security/2024/01/16/2 Common Vulnerability Exposure (CVE) ID: CVE-2023-45231 Common Vulnerability Exposure (CVE) ID: CVE-2023-45232 Common Vulnerability Exposure (CVE) ID: CVE-2023-45233 Common Vulnerability Exposure (CVE) ID: CVE-2023-45234 Common Vulnerability Exposure (CVE) ID: CVE-2023-45235 Common Vulnerability Exposure (CVE) ID: CVE-2023-48733 https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137 https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139 https://nvd.nist.gov/vuln/detail/CVE-2023-48733 https://www.openwall.com/lists/oss-security/2024/02/14/4
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.