Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-45232: EDK2 network package may hang on malformed IPv6 packets
CVE-2023-45232 · published 2 years ago
Summary
The EDK2 network component used in Debian, Tianocore and Canonical systems can get stuck in a loop when it receives IPv6 packets with unknown options. This can make the affected system unresponsive, reducing its availability. Update the EDK2 package to the latest version or apply the vendor’s patch to stop the condition.
What to do
- Update debian edk2 to version 2022.11-6+deb12u1.
- Update debian edk2 to version 2023.11-6.
- Update canonical edk2 to version 0~20191122.bd85bf54-2ubuntu3.5.
- Update canonical edk2 to version 2022.02-3ubuntu0.22.04.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | edk2 |
< 2022.11-6+deb12u1 Fix: upgrade to 2022.11-6+deb12u1
|
| Debian:13 | debian | edk2 |
< 2023.11-6 Fix: upgrade to 2023.11-6
|
| Debian:14 | debian | edk2 |
< 2023.11-6 Fix: upgrade to 2023.11-6
|
| – | tianocore | edk2 |
<= 202311 cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:16.04:LTS | canonical | edk2 | All versions |
| Ubuntu:20.04:LTS | canonical | edk2 |
< 0~20191122.bd85bf54-2ubuntu3.5 Fix: upgrade to 0~20191122.bd85bf54-2ubuntu3.5
|
| Ubuntu:22.04:LTS | canonical | edk2 |
< 2022.02-3ubuntu0.22.04.2 Fix: upgrade to 2022.02-3ubuntu0.22.04.2
|
Original advisory text
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker t...
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
References
- https://security-tracker.debian.org/tracker/CVE-2023-45232 Vendor Advisory
- http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html Third Party Advisory VDB Entry
- http://www.openwall.com/lists/oss-security/2024/01/16/2 Mailing List
- https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://security.netapp.com/advisory/ntap-20240307-0011/
- https://www.kb.cert.org/vuls/id/132380
- https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h Third Party Advisory
- https://ubuntu.com/security/CVE-2023-45232 Third Party Advisory
- https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-i... Third Party Advisory
- https://www.openwall.com/lists/oss-security/2024/01/16/2 Third Party Advisory
- https://ubuntu.com/security/notices/USN-6638-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-45232 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published16 Jan 2024
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta