CVE-2022-36764 Heap Buffer Overflow in Tcg2MeasurePeImage

What is CVE-2022-36764?

CVE-2022-36764 is a high-severity memory corruption vulnerability in TianoCore edk2, published on 9 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.

Weakness: CWE-119, CWE-122

Which versions are affected by CVE-2022-36764?

It affects 1 product.

Products include Tianocore Edk2.

How do I fix CVE-2022-36764?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-36764 being exploited?

There is no known exploitation of CVE-2022-36764 in the wild and no public exploit code.

Other vulnerabilities in TianoCore edk2

• CVE-2023-45230 Buffer Overflow in EDK II Network Package High 8.3
• CVE-2023-45234 Buffer Overflow in EDK II Network Package High 8.3
• CVE-2023-45235 Buffer Overflow in EDK II Network Package High 8.3
• CVE-2021-28210 Denial of service in EDK II High 7.8
• CVE-2019-14584 Null dereference in Tianocore EDK2 High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-39016, AZL-39097, AZL-39292, BELL-CVE-2022-36764, DEBIAN-CVE-2022-36764, GHSA-4hcq-p8q8-hj8j and 1 more.