Fluid Attacks Database

Description

EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	edk2	=2022.11-6 \|\| >=0 <2022.11-6+deb12u1	2022.11-6+deb12u1
debian 13	edk2	>=0 <2023.11-6	2023.11-6
debian 14	edk2	>=0 <2023.11-6	2023.11-6
rpm rhel8	edk2	<0:20220126gitbb1bba3d77-13.el8_10	0:20220126gitbb1bba3d77-13.el8_10
rpm rhel9.2	edk2	<0:20221207gitfff6d81270b5-9.el9_2.3	0:20221207gitfff6d81270b5-9.el9_2.3
rpm rhel8.8	edk2	<0:20220126gitbb1bba3d77-4.el8_8.5	0:20220126gitbb1bba3d77-4.el8_8.5
rpm rhel9	edk2	<0:20231122-6.el9	0:20231122-6.el9

Aliases

1. CVE-2023-452352. NVD-2023-452353. OSV-DEBIAN-2023-452354. OSV-2023-452355. SECURITY-TRACKER-CVE-2023-45235

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.