CVE-2023-45232
Published: 16 January 2024
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
Notes
Author | Note |
---|---|
eslerm | shares fixes with CVE-2023-45233 "exposure is limited to PXE boot or HTTP boot" patchset available in bug 4518, but not in repo (until Feb-24) fix and unit test commit id likely 7ec488242f6 and d925ff1f00e |
Priority
Status
Package | Release | Status |
---|---|---|
edk2 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
focal |
Released
(0~20191122.bd85bf54-2ubuntu3.5)
|
|
jammy |
Released
(2022.02-3ubuntu0.22.04.2)
|
|
lunar |
Ignored
(end of life, was needs-triage)
|
|
mantic |
Released
(2023.05-2ubuntu0.1)
|
|
noble |
Not vulnerable
(2023.11-6)
|
|
trusty |
Ignored
(end of standard support)
|
|
upstream |
Needs triage
|
|
xenial |
Needs triage
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
- https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
- https://www.openwall.com/lists/oss-security/2024/01/16/2
- https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
- https://ubuntu.com/security/notices/USN-6638-1
- https://www.cve.org/CVERecord?id=CVE-2023-45232
- NVD
- Launchpad
- Debian