CVE-2022-36763 Heap Buffer Overflow in Tcg2MeasureGptTable

What is CVE-2022-36763?

CVE-2022-36763 is a high-severity memory corruption vulnerability in TianoCore edk2, published on 9 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.

Weakness: CWE-119, CWE-122

Which versions are affected by CVE-2022-36763?

It affects 1 product.

Products include Tianocore Edk2.

How do I fix CVE-2022-36763?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-36763 being exploited?

There is no known exploitation of CVE-2022-36763 in the wild and no public exploit code.

Other vulnerabilities in TianoCore edk2

• CVE-2023-45230 Buffer Overflow in EDK II Network Package High 8.3
• CVE-2023-45234 Buffer Overflow in EDK II Network Package High 8.3
• CVE-2023-45235 Buffer Overflow in EDK II Network Package High 8.3
• CVE-2021-28210 Denial of service in EDK II High 7.8
• CVE-2019-14584 Null dereference in Tianocore EDK2 High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-38308, AZL-39247, AZL-39559, BELL-CVE-2022-36763, DEBIAN-CVE-2022-36763, GHSA-xvv8-66cq-prwr and 4 more.