CVE-2023-45232

2024-01-1616:15:12

CWE-835

TianoCore

web.nvd.nist.gov

cve-2023-45232

edk2

network package

infinite loop vulnerability

parsing

ipv6

destination options

unauthorized access

availability

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.9

Confidence

High

EPSS

0.005

Percentile

76.7%

JSON

EDK2’s Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This
vulnerability can be exploited by an attacker to gain unauthorized
access and potentially lead to a loss of Availability.

Affected configurations

Nvd

Node

tianocoreedk2Range≤202311

VendorProductVersionCPE
tianocoreedk2*cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tianocore	edk2	*	cpe:2.3:a:tianocore:edk2::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "edk2",
    "vendor": "TianoCore",
    "versions": [
      {
        "status": "affected",
        "version": "edk2-stable202308"
      }
    ]
  }
]