PT-2024-1249 · Tianocore+12 · Edk2+12

Doug Flick · Published 2024-01-16 · Updated 2026-01-21 · CVE-2023-45232

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions EDK2 (affected versions not specified)

Description The issue is related to an infinite loop vulnerability in EDK2's Network Package when parsing unknown options in the Destination Options header of IPv6. This can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability. The vulnerability is also associated with a buffer overflow in the IPv6 Options Header Handler component of the Tianocore EDK2 library, which can be exploited by a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Infinite Loop

Improper Resource Release

Weakness Enumeration

CWE-835

CWE-404

Related Identifiers

ALSA-2024:2264

ALSA-2024:3017

ALT-PU-2024-14732

ALT-PU-2024-14734

ALT-PU-2024-14950

AZL-38227

AZL-39346

AZL-39553

BDU:2024-00646

CESA-2024_3017

CVE-2023-45232

DLA-4207-1

DSA-5624-1

GHSA-HC6X-CW6P-GJ7H

INFSA-2024_2264

INFSA-2024_3017

OESA-2024-1314

OESA-2024-1315

OESA-2024-1316

OESA-2024-1317

OESA-2024-1318

OESA-2024-1319

OPENSUSE-SU-2024:14199-1

OPENSUSE-SU-2025_0407-1

OPENSUSE-SU-2025_0421-1

OPENSUSE-SU-2025_0503-1

OPENSUSE-SU-2025_0752-1

RHSA-2024:2264

RHSA-2024:3017

RHSA-2024:8104

RHSA-2024_2264

RHSA-2024_3017

RLSA-2024:2264

SUSE-SU-2025:0407-1

SUSE-SU-2025:0421-1

SUSE-SU-2025:0503-1

SUSE-SU-2025:0752-1

SUSE-SU-2025_0421-1

SUSE-SU-2025_0503-1

SUSE-SU-2026:0196-1

USN-6638-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Edk2

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Zvirt Node

References · 141

• https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-45234 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-48733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45231 · Security Note
• https://linux.oracle.com/errata/ELSA-2024-12343.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-39553 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-45232 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1315 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-20865.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1314 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6638-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:2264 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-2264.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-2264.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0752-1 · Vendor Advisory