Fluid Attacks Database

Description

EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	edk2	=2020.11-2 \|\| =2020.11-2+deb11u1 \|\| =2020.11-2+deb11u2 \|\| >=0 <2020.11-2+deb11u3	2020.11-2+deb11u3
debian 12	edk2	=2022.11-6 \|\| >=0 <2022.11-6+deb12u1	2022.11-6+deb12u1
debian 13	edk2	>=0 <2023.11-6	2023.11-6
debian 14	edk2	>=0 <2023.11-6	2023.11-6
rpm rhel8	edk2	<0:20220126gitbb1bba3d77-13.el8_10	0:20220126gitbb1bba3d77-13.el8_10
rpm rhel8.8	edk2	<0:20220126gitbb1bba3d77-4.el8_8.6	0:20220126gitbb1bba3d77-4.el8_8.6
rpm rhel9	edk2	<0:20231122-6.el9	0:20231122-6.el9

Aliases

1. CVE-2023-452332. NVD-2023-452333. OSV-DEBIAN-2023-452334. OSV-2023-452335. SECURITY-TRACKER-CVE-2023-45233

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.