openEuler update for edk2
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2024-9143 |
| CWE-ID | CWE-787 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
openEuler Operating systems & Components / Operating system python3-edk2-devel Operating systems & Components / Operating system package or component edk2-ovmf Operating systems & Components / Operating system package or component edk2-help Operating systems & Components / Operating system package or component edk2-aarch64 Operating systems & Components / Operating system package or component edk2-devel Operating systems & Components / Operating system package or component edk2-debugsource Operating systems & Components / Operating system package or component edk2-debuginfo Operating systems & Components / Operating system package or component edk2 Operating systems & Components / Operating system package or component |
| Vendor | openEuler |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Out-of-bounds write
EUVDB-ID: #VU98757
Risk: Low
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-9143
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
Description The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when using the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial. A remote attacker can send specially crafted input to the server, trigger an out-of-bounds write and perform a denial of service (DoS) attack.
Note, the vulnerability can be exploited against the application in rare cases only that involve "exotic" curve encoding.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP4 - 24.03 LTS SP1
python3-edk2-devel: before 202011-26
edk2-ovmf: before 202011-26
edk2-help: before 202011-26
edk2-aarch64: before 202011-26
edk2-devel: before 202011-26
edk2-debugsource: before 202011-26
edk2-debuginfo: before 202011-26
edk2: before 202011-26
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP3:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP4:*:*:*:*:*:*
- cpe:2.3:a:openeuler:python3-edk2-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:edk2-ovmf:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:edk2-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:edk2-aarch64:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:edk2-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:edk2-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:edk2-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:edk2:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1352
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
