CVE-2022-36765

A flaw was found in the CreateHob() function in EDK2. An attacker, leveraging a local network, can initiate an integer overflow leading to a buffer overflow. This issue arises during size alignment within the CreateHob() function, requiring activation in the PEI phase. Successful exploitation of this flaw poses a moderate threat to confidentiality and integrity, however, the primary consequence is likely a crash or denial of service.

Red Hat has protection mechanisms in place against buffer overflows, such as FORTIFY_SOURCE, Position Independent Executables or Stack Smashing Protection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.