Infinite loop in EDK II Network Package

CVE-2023-45233

What is CVE-2023-45233?

EDK2's Network Package, developed by TianoCore, presents a vulnerability where an infinite loop can occur when parsing a PadN option in the Destination Options header of IPv6. This flaw exposes systems to potential exploitation, allowing an attacker unauthorized access that could significantly compromise the availability of the affected services. Given the nature of the vulnerability, it is critical for organizations utilizing this package to assess their exposure and implement necessary mitigations to safeguard their infrastructures.

References