{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux7els/vex/2024/cve-2024-1298-els_os-oraclelinux7els.json" } ], "tracking": { "current_release_date": "2026-11-12T03:46:14Z", "generator": { "date": "2026-11-12T03:46:14Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2024-1298-ELS_OS-ORACLELINUX7ELS", "initial_release_date": "2024-05-30T21:15:00Z", "revision_history": [ { "date": "2024-05-30T21:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-11-12T03:46:14Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2024-1298" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 7", "product": { "name": "Oracle Linux 7", "product_id": "Oracle-Linux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" }, { "branches": [ { "category": "product_version", "name": "OVMF-0:20180508-6.gitee3198e672e2.el7.noarch", "product": { "name": "OVMF-0:20180508-6.gitee3198e672e2.el7.noarch", "product_id": "OVMF-0:20180508-6.gitee3198e672e2.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/oracle/OVMF@20180508-6.gitee3198e672e2.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "OVMF-0:20180508-6.gitee3198e672e2.el7.tuxcare.els2.noarch", "product": { "name": "OVMF-0:20180508-6.gitee3198e672e2.el7.tuxcare.els2.noarch", "product_id": "OVMF-0:20180508-6.gitee3198e672e2.el7.tuxcare.els2.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/OVMF@20180508-6.gitee3198e672e2.el7.tuxcare.els2?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "OVMF-0:20180508-6.gitee3198e672e2.el7.tuxcare.els2.noarch as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:OVMF-0:20180508-6.gitee3198e672e2.el7.tuxcare.els2.noarch" }, "product_reference": "OVMF-0:20180508-6.gitee3198e672e2.el7.tuxcare.els2.noarch", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "OVMF-0:20180508-6.gitee3198e672e2.el7.noarch as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:OVMF-0:20180508-6.gitee3198e672e2.el7.noarch" }, "product_reference": "OVMF-0:20180508-6.gitee3198e672e2.el7.noarch", "relates_to_product_reference": "Oracle-Linux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-1298", "cwe": { "id": "CWE-369", "name": "Divide By Zero" }, "notes": [ { "category": "description", "text": "EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "Oracle-Linux-7:OVMF-0:20180508-6.gitee3198e672e2.el7.noarch", "Oracle-Linux-7:OVMF-0:20180508-6.gitee3198e672e2.el7.tuxcare.els2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-1298" }, { "category": "external", "summary": "https://github.com/tianocore/edk2/security/advisories/GHSA-chfw-xj8f-6m53", "url": "https://github.com/tianocore/edk2/security/advisories/GHSA-chfw-xj8f-6m53" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7NUL7NSZQ76A5OKDUCODQNY7WSX4SST/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7NUL7NSZQ76A5OKDUCODQNY7WSX4SST/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIMEZWDKEIQKU7NMHKL57DOCITPGEXYN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIMEZWDKEIQKU7NMHKL57DOCITPGEXYN/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20250306-0002/", "url": "https://security.netapp.com/advisory/ntap-20250306-0002/" } ], "release_date": "2024-05-30T21:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-10-29T16:14:08.067565Z", "details": "This issue is only reachable during S3 (suspend-to-RAM) resume and requires local, high-privilege access, resulting solely in a denial-of-service (no confidentiality or integrity impact). In standard VM and server configurations, ACPI S3 is not active by default and is often unsupported or requires explicit enablement in virtual firmware or server BIOS, leaving the vulnerable path unused. Given the need for non-default S3 activation plus already-admin privileges, practical exploitability is low and this can be deprioritized.", "product_ids": [ "Oracle-Linux-7:OVMF-0:20180508-6.gitee3198e672e2.el7.noarch", "Oracle-Linux-7:OVMF-0:20180508-6.gitee3198e672e2.el7.tuxcare.els2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:OVMF-0:20180508-6.gitee3198e672e2.el7.noarch", "Oracle-Linux-7:OVMF-0:20180508-6.gitee3198e672e2.el7.tuxcare.els2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }