Predictable TCP ISNs in EDK II Network Package

CVE-2023-45236

What is CVE-2023-45236?

The EDK2 Network Package by TianoCore is vulnerable due to a predictable TCP Initial Sequence Number (ISN). This flaw may allow an attacker to predict the ISN, facilitating unauthorized access and compromising the confidentiality of the network communications. Exploiting this vulnerability could lead to further attacks, including session hijacking, making it crucial for users and administrators to apply appropriate security measures.

References