Integer Overflow in CreateHob

CVE-2022-36765

What is CVE-2022-36765?

The EDK2 firmware platform, developed by TianoCore, has a vulnerability arising from integer overflow in the CreateHob() function. This flaw enables an attacker to exploit the system by triggering a buffer overflow through a local network connection. Such exploitation can compromise essential security attributes of the system, including confidentiality, integrity, and availability. It is crucial for users to ensure their EDK2 components are updated to mitigate potential risks associated with this vulnerability.

References