CVE-2023-45232

Name
CVE-2023-45232
Description
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vendor-advisory https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
infosec@edk2.groups.io http://www.openwall.com/lists/oss-security/2024/01/16/2
infosec@edk2.groups.io http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
infosec@edk2.groups.io https://security.netapp.com/advisory/ntap-20240307-0011/
infosec@edk2.groups.io https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html
af854a3a-2127-422b-91ae-364da2661108 https://www.kb.cert.org/vuls/id/132380

Match rules

CPE URI Source package Min version Max version
edk2 == edk2-stable202308 == edk2-stable202308

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
edk2 edge-community 0.0.202508-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
edk2 edge-community 0.0.202508-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
edk2 edge-community 0.0.202508-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
edk2 edge-community 0.0.202308-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
edk2 3.22-community 0.0.202308-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
edk2 3.20-community 0.0.202308-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
edk2 3.19-community 0.0.202308-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable