Use of a Weak PseudoRandom Number Generator in EDK II Network Package

CVE-2023-45237

What is CVE-2023-45237?

The EDK2 Network Package developed by TianoCore has a susceptibility due to the predictability of the TCP Initial Sequence Number, which may be exploited by attackers to gain unauthorized access. This flaw can lead to significant security risks, including potential breaches of confidentiality, as attackers can manipulate network traffic more easily. Proper measures should be taken to mitigate this risk in affected environments.

References