CVE-2022-36765: Integer Overflow in CreateHob

Vulnerability summary

CVE-2022-36765 is a high (CVSS 7.8) Integer Overflow to Buffer Overflow vulnerability in tianocore edk2. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.5% of scored vulnerabilities.

Timeline

1. 09-01-2024
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.

• CWE-680Integer Overflow to Buffer OverflowThe product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.