CVE-2023-45237: Use of a Weak PseudoRandom Number Generator in EDK II Network Package
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
Other sources
https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html https://github.com/advisories/GHSA-fxqf-p2p3-gxvr
— Red Hat
Use of a Weak PseudoRandom Number Generator in EDK II Network Package
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-45237?
CVE-2023-45237 has a high severity rating due to the potential for unauthorized access and loss of confidentiality.
How can I mitigate CVE-2023-45237?
Mitigation for CVE-2023-45237 involves updating the EDK2's Network Package to a version beyond 202311.
What impact does CVE-2023-45237 have on affected systems?
CVE-2023-45237 can allow attackers to predict TCP Initial Sequence Numbers, leading to potential attacks on data confidentiality.
Which versions of EDK2 are affected by CVE-2023-45237?
CVE-2023-45237 affects all versions of EDK2 up to and including version 202311.
Is CVE-2023-45237 being actively exploited?
As of the latest information, there are no confirmed active exploitation reports for CVE-2023-45237, but the vulnerability should be addressed promptly.