Fluid Attacks Database

Description

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	edk2	=2020.11-2 \|\| =2020.11-2+deb11u1 \|\| =2020.11-2+deb11u2 \|\| >=0 <2020.11-2+deb11u3	2020.11-2+deb11u3
debian 12	edk2	=2022.11-6 \|\| >=0 <2022.11-6+deb12u1	2022.11-6+deb12u1
debian 13	edk2	>=0 <2023.11-6	2023.11-6
debian 14	edk2	>=0 <2023.11-6	2023.11-6
rpm rhel8	edk2	<0:20220126gitbb1bba3d77-13.el8_10	0:20220126gitbb1bba3d77-13.el8_10
rpm rhel9	edk2	<0:20231122-6.el9	0:20231122-6.el9
rpm rhel9.2	edk2	<0:20221207gitfff6d81270b5-9.el9_2.3	0:20221207gitfff6d81270b5-9.el9_2.3

Aliases

1. CVE-2023-452292. NVD-2023-452293. OSV-DEBIAN-2023-452294. OSV-2023-452295. SECURITY-TRACKER-CVE-2023-45229

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.