CVE-2022-36764 – CVE-2022-36764 is a heap buffer overflow vulner... (How to Fix)

Q: What is the severity of CVE-2022-36764?

CVE-2022-36764 has a CVSS score of 7.0 (HIGH). CVE-2022-36764 is a heap buffer overflow vulnerability in EDK2's Tcg2MeasurePeImage() function that allows local network attackers to potentially execute arbitrary code or cause denial of service. This affects systems using EDK2 firmware, particularly those with TPM measurements enabled. Successful exploitation could compromise system confidentiality, integrity, and availability.

📋 TL;DR

CVE-2022-36764 is a heap buffer overflow vulnerability in EDK2's Tcg2MeasurePeImage() function that allows local network attackers to potentially execute arbitrary code or cause denial of service. This affects systems using EDK2 firmware, particularly those with TPM measurements enabled. Successful exploitation could compromise system confidentiality, integrity, and availability.

💻 Affected Systems

Products:

EDK2 (UEFI Development Kit)

Versions: EDK2 versions prior to commit 0b2e297 (2022-08-22)

Operating Systems: Any OS running on systems with vulnerable EDK2 firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Systems must have TPM measurements enabled via Tcg2MeasurePeImage() function. Many UEFI implementations based on EDK2 are affected.

📦 What is this software?

Edk2 by Tianocore

View all CVEs affecting Edk2 →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise allowing attacker to execute arbitrary code at firmware level, potentially bypassing OS security controls and establishing persistent access.

🟠

Likely Case

System crash or denial of service, with potential for limited code execution depending on exploit sophistication and system configuration.

🟢

If Mitigated

Minimal impact if systems are patched, have network segmentation, and restrict local network access to firmware management interfaces.

🌐 Internet-Facing: LOW - Exploitation requires local network access to the vulnerable function.

🏢 Internal Only: MEDIUM - Attackers on the local network could potentially exploit this vulnerability to compromise systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires local network access to trigger the vulnerable function. No public exploit code has been identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: EDK2 commit 0b2e297 or later

Vendor Advisory: https://github.com/tianocore/edk2/security/advisories/GHSA-4hcq-p8q8-hj8j

Restart Required: Yes

Instructions:

1. Update EDK2 firmware to version containing commit 0b2e297 or later. 2. Check with your hardware vendor for firmware updates. 3. Apply firmware updates following vendor instructions. 4. Reboot system to activate new firmware.

🔧 Temporary Workarounds

Network Segmentation

all

Restrict access to firmware management interfaces to trusted networks only

Disable TPM Measurements

all

If not required, disable TPM/TCG measurements in firmware settings

🧯 If You Can't Patch

Implement strict network segmentation to isolate systems from untrusted local networks
Monitor for unusual firmware access attempts and system crashes

🔍 How to Verify

Check if Vulnerable:

Check EDK2 version: dmidecode -t bios | grep Version. Compare against vulnerable versions. Check if commit 0b2e297 is present in EDK2 source.

Check Version:

dmidecode -t bios | grep Version

Verify Fix Applied:

Verify EDK2 version contains commit 0b2e297 or later. Check with vendor for specific firmware version that includes the fix.

📡 Detection & Monitoring

Log Indicators:

Unexpected system crashes or reboots
Firmware access logs showing unusual patterns

Network Indicators:

Unusual network traffic to firmware management interfaces
Local network scanning for vulnerable systems

SIEM Query:

source="bios_logs" AND (event="crash" OR event="unexpected_reboot") OR source="network_logs" AND dest_port IN (firmware_management_ports)

📊 Metadata

CVE ID: CVE-2022-36764

CVSS v3 Score: 7.0 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

CWE: CWE-122

Published: January 9, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-36764, you might also want to check these: