CVE-2023-45234: Buffer Overflow in EDK II Network Package
EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
Other sources
https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html https://github.com/advisories/GHSA-mrjv-p9q7-rxgr
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-45234?
CVE-2023-45234 is identified as a high-severity vulnerability due to its potential for unauthorized access and information disclosure.
How do I fix CVE-2023-45234?
To mitigate CVE-2023-45234, update the affected EDK2 package to a version that addresses this vulnerability, such as 0~20191122 for Ubuntu Focal or 2022.11-6 for Debian.
Which software is affected by CVE-2023-45234?
CVE-2023-45234 affects the EDK2 package in various versions across several distributions, including Ubuntu and Debian.
What is the nature of CVE-2023-45234?
CVE-2023-45234 is a buffer overflow vulnerability that occurs when processing DNS Servers options from a DHCPv6 Advertise message.
Can CVE-2023-45234 lead to remote code execution?
Yes, CVE-2023-45234 can potentially allow an attacker to execute arbitrary code, leading to significant security risks.