CVEvulnerability
CVE-2023-45232
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-01-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-835
Description
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This
vulnerability can be exploited by an attacker to gain unauthorized
access and potentially lead to a loss of Availability.
Affected configurations
• tianocore edk2 (<= 202311)
Related
Weakness · CWE (1)
- CWE-835 Loop with Unreachable Exit Condition weakness
References
- http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2024/01/16/2 Mailing List
- https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h Vendor Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20240307-0011/ security.netapp.com
- http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2024/01/16/2 Mailing List
- https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20240307-0011/ security.netapp.com
- https://www.kb.cert.org/vuls/id/132380 www.kb.cert.org