Buffer Overflow in EDK II Network Package

CVE-2023-45235

What is CVE-2023-45235?

The EDK2 Network Package by Tianocore is vulnerable to a buffer overflow when processing the Server ID option from DHCPv6 proxy Advertise messages. This flaw can be exploited by attackers to execute arbitrary code, leading to unauthorized access that compromises the confidentiality, integrity, and availability of affected systems. Proper network security measures and timely updates are essential to mitigate the risks associated with this vulnerability.

References