Logo
›
›vulnerability›CVE-2023-45235
Name
CVE-2023-45235
Source
NVD ( link)Debian ( link)
Description
EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
CWEs
CWE-119 CWE-119
Published Date
Updated Date
Workaround
-
Advisories
http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.htmlVDB Entry
http://www.openwall.com/lists/oss-security/2024/01/16/2Mailing List
https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7hVendor Advisory
http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.htmlVDB Entry
http://www.openwall.com/lists/oss-security/2024/01/16/2Mailing List
https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7hVendor Advisory

Analysis#

Affected Component
Analysis
ovmf
Patched

Vulnerability Ratings#

8.3
CVSSv31
8.8
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
edk2
buildroot
2025.02.x
edk2-stable202411
Not Affected
edk2
buildroot
master
edk2-stable202602
Not Affected
ovmf
yocto
master
edk2-stable202511
Not Affected
ovmf
yocto
scarthgap
edk2-stable202402
Not Affected

Resolved with patches#

ovmf (yocto:kirkstone)

#
Title
Author
Resolve
1
NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235 Unit
Doug Flick <dougflick@microsoft.com>
CVE-2023-45235
2
NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235 Patch
Doug Flick <dougflick@microsoft.com>
CVE-2023-45235