Infinite loop in EDK II Network Package
CVE-2023-45232

7.5HIGH

Key Information:

Vendor

Tianocore

Status
Edk2
Vendor
CVE Published:
16 January 2024

What is CVE-2023-45232?

The EDK2 Network Package from TianoCore is affected by a vulnerability that introduces an infinite loop when handling unknown options in the Destination Options header of IPv6. This issue can be exploited by attackers to manipulate packet processing, potentially leading to unauthorized access and significant disruption of service availability. Proper patching and monitoring of the affected products are essential to mitigate these security risks.

Affected Version(s)

edk2 edk2-stable202308

References

https://github.com/tianocore/edk2/security/advisories/GHS...
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/01/16/2
http://packetstormsecurity.com/files/176574/PixieFail-Pro...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Quarkslab Vulnerability Reports Team
Doug Flick
.