CVE-2023-45232

Published Jan 16, 2024

Last updated 8 months ago

Overview

Description: EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
Source: infosec@edk2.groups.io
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-835
infosec@edk2.groups.io: CWE-835

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3CEB3105-57CC-4096-81D3-D58005813C4B",
            "versionEndIncluding": "202311"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References