EDK II MdePkg (CreateHob, HOB list construction): An integer overflow in the routine that allocates Hand-Off Blocks

CVSS 7.8CVE-2022-36765Firmware, BMC & network fabricGHSA-ch4w-v7m3-g8wxcurated

Impact

An integer overflow in the routine that allocates Hand-Off Blocks lets an attacker read and write outside the HOB list. HOBs are the structure PEI uses to describe memory, security state and platform configuration to DXE, so corrupting them is a way to lie to the rest of the boot about what is trusted - including the memory ranges Secure Boot and SMM protections are supposed to cover. Result is early-boot code execution with the firmware's own privileges.

Who can reach it

Requires influence over PEI-phase input on the node - typically a local attacker with the ability to feed the early boot path (attacker-controlled firmware volume content, a malicious capsule, or an earlier compromise that persists into PEI). Not remotely reachable.

What to do

OEM BIOS update - the fix is a core MdePkg change, so every IBV downstream of edk2 had to rebase it, and coverage in shipped server images varies by platform generation. Flash + reboot per node. No configuration mitigates it; the only operational lever is keeping firmware-write paths (capsule update, SPI programming) locked down so an attacker cannot get to PEI in the first place.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-36765 https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.