CVE-2024-1298

MEDIUM

TianoCore edk2 < edk2-stable202405 - Denial of Service via Division-By-Zero in S3 Sleep Activation

Title source: llm

Description

EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.

References (5)

Core 5

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html

Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/F7NUL7NSZQ76A5OKDUCODQNY7WSX4SST/

Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/VIMEZWDKEIQKU7NMHKL57DOCITPGEXYN/

Vendor Advisory

https://github.com/tianocore/edk2/security/advisories/GHSA-chfw-xj8f-6m53

Vendor Advisory

https://security.netapp.com/advisory/ntap-20250306-0002/

Scores

CVSS v3 6.0

EPSS 0.0022

EPSS Percentile 12.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-369

Status published

Products (1)

TianoCore/edk2 < edk2-stable202405

Published May 30, 2024

Tracked Since Feb 18, 2026