CVE-2024-38798

Publication date 9 December 2025

Last updated 27 August 2026

Ubuntu priority

Medium

Why this priority?

Description

EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability will lead to possible information disclosure or escalation of privilege and impact Confidentiality.

Status

Package Ubuntu Release Status
edk2 26.04 LTS resolute
Not affected
25.10 questing Ignored end of life, was needs-triage
25.04 plucky Ignored end of life, was needs-triage
24.04 LTS noble
Needs evaluation
22.04 LTS jammy
Needs evaluation
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation
edk2-hwe 26.04 LTS resolute
Not affected
24.04 LTS noble Not in release
22.04 LTS jammy Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
edk2

Severity score breakdown

CVSS version: CVSS v4.0

Base score 5.8 · Medium

Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L

References

Other references

Access our resources on patching vulnerabilities