Medium

UBUNTU-CVE-2024-38798

Type: advisorySource: OSV1 source record

EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability will lead to possible information disclosure or escalation of privilege and impact Confidentiality.

Announced 9 Dec 2025Source revision 1

Original source ↗

UBUNTU-CVE-2024-38798

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2024-38798

edk2

Source reference: /affected/0/package/name

Affected versions: 0~20150106.5c2d456b-2
Source reference: /affected/0/versions
0~20160104.c2a892d7-1
Source reference: /affected/0/versions
0~20160408.ffea0a2c-2
Source reference: /affected/0/versions
0~20160408.ffea0a2c-2ubuntu0.1
Source reference: /affected/0/versions
0~20160408.ffea0a2c-2ubuntu0.2
Source reference: /affected/0/versions
0~20160408.ffea0a2c-2ubuntu0.2+esm1
Source reference: /affected/0/versions
0~20160408.ffea0a2c-2ubuntu0.2+esm3
Source reference: /affected/0/versions
0~20160408.ffea0a2c-2ubuntu0.2+esm4
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

edk2

Source reference: /affected/1/package/name

Affected versions: 0~20170911.5dfba97c-1
Source reference: /affected/1/versions
0~20171010.234dbcef-1
Source reference: /affected/1/versions
0~20171027.76fd5a66-1
Source reference: /affected/1/versions
0~20171205.a9212288-1
Source reference: /affected/1/versions
0~20180105.0bc94c74-1
Source reference: /affected/1/versions
0~20180205.c0d9813c-1
Source reference: /affected/1/versions
0~20180205.c0d9813c-2
Source reference: /affected/1/versions
0~20180205.c0d9813c-2ubuntu0.1
Source reference: /affected/1/versions
0~20180205.c0d9813c-2ubuntu0.2
Source reference: /affected/1/versions
0~20180205.c0d9813c-2ubuntu0.3
Source reference: /affected/1/versions
0~20180205.c0d9813c-2ubuntu0.3+esm1
Source reference: /affected/1/versions
0~20180205.c0d9813c-2ubuntu0.3+esm2
Source reference: /affected/1/versions
0~20180205.c0d9813c-2ubuntu0.3+esm3
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

edk2

Source reference: /affected/2/package/name

Affected versions: 0~20190606.20d2e5a1-2ubuntu1
Source reference: /affected/2/versions
0~20190828.37eef910-3
Source reference: /affected/2/versions
0~20190828.37eef910-4
Source reference: /affected/2/versions
0~20191122.bd85bf54-1
Source reference: /affected/2/versions
0~20191122.bd85bf54-1ubuntu1
Source reference: /affected/2/versions
0~20191122.bd85bf54-2
Source reference: /affected/2/versions
0~20191122.bd85bf54-2ubuntu1
Source reference: /affected/2/versions
0~20191122.bd85bf54-2ubuntu2
Source reference: /affected/2/versions
0~20191122.bd85bf54-2ubuntu3
Source reference: /affected/2/versions
0~20191122.bd85bf54-2ubuntu3.1
Source reference: /affected/2/versions
0~20191122.bd85bf54-2ubuntu3.2
Source reference: /affected/2/versions
0~20191122.bd85bf54-2ubuntu3.3
Source reference: /affected/2/versions
0~20191122.bd85bf54-2ubuntu3.4
Source reference: /affected/2/versions
0~20191122.bd85bf54-2ubuntu3.5
Source reference: /affected/2/versions
0~20191122.bd85bf54-2ubuntu3.6
Source reference: /affected/2/versions
0~20191122.bd85bf54-2ubuntu3.6+esm1
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

edk2

Source reference: /affected/3/package/name

Affected versions: 2021.08~rc0-2
Source reference: /affected/3/versions
2021.08-3
Source reference: /affected/3/versions
2021.11~rc1-1
Source reference: /affected/3/versions
2021.11-1
Source reference: /affected/3/versions
2021.11-2
Source reference: /affected/3/versions
2022.02~rc1-1
Source reference: /affected/3/versions
2022.02~rc1-1ubuntu1
Source reference: /affected/3/versions
2022.02-1
Source reference: /affected/3/versions
2022.02-2
Source reference: /affected/3/versions
2022.02-3
Source reference: /affected/3/versions
2022.02-3ubuntu0.22.04.1
Source reference: /affected/3/versions
2022.02-3ubuntu0.22.04.2
Source reference: /affected/3/versions
2022.02-3ubuntu0.22.04.3
Source reference: /affected/3/versions
2022.02-3ubuntu0.22.04.4
Source reference: /affected/3/versions
2022.02-3ubuntu0.22.04.5
Source reference: /affected/3/versions
2022.02-3ubuntu0.22.04.6
Source reference: /affected/3/versions
2022.02-3ubuntu0.22.04.7
Source reference: /affected/3/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

edk2

Source reference: /affected/4/package/name

Affected versions: 2023.05-2
Source reference: /affected/4/versions
2023.11-2
Source reference: /affected/4/versions
2023.11-3
Source reference: /affected/4/versions
2023.11-4
Source reference: /affected/4/versions
2023.11-5
Source reference: /affected/4/versions
2023.11-6
Source reference: /affected/4/versions
2023.11-8
Source reference: /affected/4/versions
2024.02-1
Source reference: /affected/4/versions
2024.02-2
Source reference: /affected/4/versions
2024.02-2ubuntu0.1
Source reference: /affected/4/versions
2024.02-2ubuntu0.3
Source reference: /affected/4/versions
2024.02-2ubuntu0.4
Source reference: /affected/4/versions
2024.02-2ubuntu0.5
Source reference: /affected/4/versions
2024.02-2ubuntu0.6
Source reference: /affected/4/versions
2024.02-2ubuntu0.7
Source reference: /affected/4/versions
2024.02-2ubuntu0.8
Source reference: /affected/4/versions
2024.02-2ubuntu0.9
Source reference: /affected/4/versions
2024.02-2ubuntu0.10
Source reference: /affected/4/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

edk2

Source reference: /affected/5/package/name

Affected versions: 2025.02-3ubuntu2
Source reference: /affected/5/versions
2025.02-8
Source reference: /affected/5/versions
2025.02-8ubuntu1
Source reference: /affected/5/versions
2025.02-8ubuntu2
Source reference: /affected/5/versions
2025.02-8ubuntu3
Source reference: /affected/5/versions
2025.02-8ubuntu3.1
Source reference: /affected/5/versions
2025.02-8ubuntu3.2
Source reference: /affected/5/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "edk2",
      "purl": "pkg:deb/ubuntu/edk2?arch=source&distro=esm-apps-legacy%2Fxenial",
      "ecosystem": "Ubuntu:Pro:16.04:LTS"
    },
    "versions": [
      "0~20150106.5c2d456b-2",
      "0~20160104.c2a892d7-1",
      "0~20160408.ffea0a2c-2",
      "0~20160408.ffea0a2c-2ubuntu0.1",
      "0~20160408.ffea0a2c-2ubuntu0.2",
      "0~20160408.ffea0a2c-2ubuntu0.2+esm1",
      "0~20160408.ffea0a2c-2ubuntu0.2+esm3",
      "0~20160408.ffea0a2c-2ubuntu0.2+esm4"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38798.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "ovmf",
          "binary_version": "0~20160408.ffea0a2c-2ubuntu0.2+esm4"
        },
        {
          "binary_name": "qemu-efi",
          "binary_version": "0~20160408.ffea0a2c-2ubuntu0.2+esm4"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "edk2",
      "purl": "pkg:deb/ubuntu/edk2?arch=source&distro=esm-apps%2Fbionic",
      "ecosystem": "Ubuntu:Pro:18.04:LTS"
    },
    "versions": [
      "0~20170911.5dfba97c-1",
      "0~20171010.234dbcef-1",
      "0~20171027.76fd5a66-1",
      "0~20171205.a9212288-1",
      "0~20180105.0bc94c74-1",
      "0~20180205.c0d9813c-1",
      "0~20180205.c0d9813c-2",
      "0~20180205.c0d9813c-2ubuntu0.1",
      "0~20180205.c0d9813c-2ubuntu0.2",
      "0~20180205.c0d9813c-2ubuntu0.3",
      "0~20180205.c0d9813c-2ubuntu0.3+esm1",
      "0~20180205.c0d9813c-2ubuntu0.3+esm2",
      "0~20180205.c0d9813c-2ubuntu0.3+esm3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38798.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "ovmf",
          "binary_version": "0~20180205.c0d9813c-2ubuntu0.3+esm3"
        },
        {
          "binary_name": "qemu-efi",
          "binary_version": "0~20180205.c0d9813c-2ubuntu0.3+esm3"
        },
        {
          "binary_name": "qemu-efi-aarch64",
          "binary_version": "0~20180205.c0d9813c-2ubuntu0.3+esm3"
        },
        {
          "binary_name": "qemu-efi-arm",
          "binary_version": "0~20180205.c0d9813c-2ubuntu0.3+esm3"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "edk2",
      "purl": "pkg:deb/ubuntu/edk2?arch=source&distro=esm-infra%2Ffocal",
      "ecosystem": "Ubuntu:Pro:20.04:LTS"
    },
    "versions": [
      "0~20190606.20d2e5a1-2ubuntu1",
      "0~20190828.37eef910-3",
      "0~20190828.37eef910-4",
      "0~20191122.bd85bf54-1",
      "0~20191122.bd85bf54-1ubuntu1",
      "0~20191122.bd85bf54-2",
      "0~20191122.bd85bf54-2ubuntu1",
      "0~20191122.bd85bf54-2ubuntu2",
      "0~20191122.bd85bf54-2ubuntu3",
      "0~20191122.bd85bf54-2ubuntu3.1",
      "0~20191122.bd85bf54-2ubuntu3.2",
      "0~20191122.bd85bf54-2ubuntu3.3",
      "0~20191122.bd85bf54-2ubuntu3.4",
      "0~20191122.bd85bf54-2ubuntu3.5",
      "0~20191122.bd85bf54-2ubuntu3.6",
      "0~20191122.bd85bf54-2ubuntu3.6+esm1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38798.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "ovmf",
          "binary_version": "0~20191122.bd85bf54-2ubuntu3.6+esm1"
        },
        {
          "binary_name": "qemu-efi",
          "binary_version": "0~20191122.bd85bf54-2ubuntu3.6+esm1"
        },
        {
          "binary_name": "qemu-efi-aarch64",
          "binary_version": "0~20191122.bd85bf54-2ubuntu3.6+esm1"
        },
        {
          "binary_name": "qemu-efi-arm",
          "binary_version": "0~20191122.bd85bf54-2ubuntu3.6+esm1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "edk2",
      "purl": "pkg:deb/ubuntu/edk2?arch=source&distro=jammy",
      "ecosystem": "Ubuntu:22.04:LTS"
    },
    "versions": [
      "2021.08~rc0-2",
      "2021.08-3",
      "2021.11~rc1-1",
      "2021.11-1",
      "2021.11-2",
      "2022.02~rc1-1",
      "2022.02~rc1-1ubuntu1",
      "2022.02-1",
      "2022.02-2",
      "2022.02-3",
      "2022.02-3ubuntu0.22.04.1",
      "2022.02-3ubuntu0.22.04.2",
      "2022.02-3ubuntu0.22.04.3",
      "2022.02-3ubuntu0.22.04.4",
      "2022.02-3ubuntu0.22.04.5",
      "2022.02-3ubuntu0.22.04.6",
      "2022.02-3ubuntu0.22.04.7"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38798.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "ovmf",
          "binary_version": "2022.02-3ubuntu0.22.04.7"
        },
        {
          "binary_name": "ovmf-ia32",
          "binary_version": "2022.02-3ubuntu0.22.04.7"
        },
        {
          "binary_name": "qemu-efi",
          "binary_version": "2022.02-3ubuntu0.22.04.7"
        },
        {
          "binary_name": "qemu-efi-aarch64",
          "binary_version": "2022.02-3ubuntu0.22.04.7"
        },
        {
          "binary_name": "qemu-efi-arm",
          "binary_version": "2022.02-3ubuntu0.22.04.7"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "edk2",
      "purl": "pkg:deb/ubuntu/edk2?arch=source&distro=noble",
      "ecosystem": "Ubuntu:24.04:LTS"
    },
    "versions": [
      "2023.05-2",
      "2023.11-2",
      "2023.11-3",
      "2023.11-4",
      "2023.11-5",
      "2023.11-6",
      "2023.11-8",
      "2024.02-1",
      "2024.02-2",
      "2024.02-2ubuntu0.1",
      "2024.02-2ubuntu0.3",
      "2024.02-2ubuntu0.4",
      "2024.02-2ubuntu0.5",
      "2024.02-2ubuntu0.6",
      "2024.02-2ubuntu0.7",
      "2024.02-2ubuntu0.8",
      "2024.02-2ubuntu0.9",
      "2024.02-2ubuntu0.10"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38798.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "efi-shell-aa64",
          "binary_version": "2024.02-2ubuntu0.10"
        },
        {
          "binary_name": "efi-shell-arm",
          "binary_version": "2024.02-2ubuntu0.10"
        },
        {
          "binary_name": "efi-shell-ia32",
          "binary_version": "2024.02-2ubuntu0.10"
        },
        {
          "binary_name": "efi-shell-riscv64",
          "binary_version": "2024.02-2ubuntu0.10"
        },
        {
          "binary_name": "efi-shell-x64",
          "binary_version": "2024.02-2ubuntu0.10"
        },
        {
          "binary_name": "ovmf",
          "binary_version": "2024.02-2ubuntu0.10"
        },
        {
          "binary_name": "ovmf-ia32",
          "binary_version": "2024.02-2ubuntu0.10"
        },
        {
          "binary_name": "ovmf-legacy",
          "binary_version": "2024.02-2ubuntu0.10"
        },
        {
          "binary_name": "qemu-efi-aarch64",
          "binary_version": "2024.02-2ubuntu0.10"
        },
        {
          "binary_name": "qemu-efi-arm",
          "binary_version": "2024.02-2ubuntu0.10"
        },
        {
          "binary_name": "qemu-efi-riscv64",
          "binary_version": "2024.02-2ubuntu0.10"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "edk2",
      "purl": "pkg:deb/ubuntu/edk2?arch=source&distro=questing",
      "ecosystem": "Ubuntu:25.10"
    },
    "versions": [
      "2025.02-3ubuntu2",
      "2025.02-8",
      "2025.02-8ubuntu1",
      "2025.02-8ubuntu2",
      "2025.02-8ubuntu3",
      "2025.02-8ubuntu3.1",
      "2025.02-8ubuntu3.2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38798.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "efi-shell-aa64",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "efi-shell-arm",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "efi-shell-ia32",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "efi-shell-loongarch64",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "efi-shell-riscv64",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "efi-shell-x64",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "ovmf",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "ovmf-ia32",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "ovmf-inteltdx",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "ovmf-legacy",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "qemu-efi-aarch64",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "qemu-efi-arm",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "qemu-efi-loongarch64",
          "binary_version": "2025.02-8ubuntu3.2"
        },
        {
          "binary_name": "qemu-efi-riscv64",
          "binary_version": "2025.02-8ubuntu3.2"
        }
      ]
    }
  }
]

Related CVEs: CVE-2024-38798
Source reference: /upstream

Publisher severity

medium

Source reference: /severity/0/score

Event: #85730 · Revision 1
Added to Heist Feed: Tue, 27 Oct 2026 03:57:39 GMT
Publisher date: Tue, 09 Dec 2025 16:17:00 GMT

Read the original announcement