CVE-2023-45232

Name
CVE-2023-45232
Description
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
infosec@edk2.groups.io https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
infosec@edk2.groups.io http://www.openwall.com/lists/oss-security/2024/01/16/2
infosec@edk2.groups.io http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:* edk2 >= None <= 202311

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
edk2 edge-community 0.0.202308-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
edk2 3.19-community 0.0.202308-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable