CVE-2024-1298

What it actually does

A UINT32 overflow during S3 sleep handling in EDK2 leads to a division-by-zero condition that crashes the firmware and causes loss of system availability.

Why it matters to the business

Systems become unavailable until a manual reboot or power cycle, interrupting workloads and requiring administrative intervention; the issue is limited to local high-privilege access and shows no signs of active exploitation or ransomware use.

How an attack unfolds

An attacker with local administrative access triggers S3 sleep, supplying crafted data that causes the UINT32 overflow and subsequent division-by-zero in the firmware handler, halting the system.

How to fix it

Upgrade affected chromium packages on Debian 11 to version 119.0.6045.199-1~deb11u1 or later; apply equivalent firmware or EDK2 updates from the platform vendor when available.

How to confirm the fix worked

Confirm the installed chromium package version meets or exceeds 119.0.6045.199-1~deb11u1; re-test S3 sleep transitions on updated systems to verify stability; review vendor firmware release notes for EDK2 fixes.

Typical attack path

1. Obtain local administrative access to the target system
2. Issue an S3 sleep command or equivalent power-state transition
3. Supply input that triggers the UINT32 overflow path in EDK2
4. Observe division-by-zero fault and resulting denial of service

How to detect it

Review system and firmware logs around S3 sleep events for division-by-zero faults or unexpected reboots; correlate with local administrative sessions; no public indicators of prior exploitation exist.

What your security team should do

• Prioritize patching chromium on all Debian 11 systems to the listed fixed version
• Monitor vendor firmware advisories for EDK2-related updates
• Test S3 sleep behavior in a lab environment before broad deployment
• Document the low EPSS score and absence from KEV when communicating risk to stakeholders