CVE-2023-45232
Assigner: TianoCore
Published: 2024-01-16T16:12:32.584Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: edk2
vendor: TianoCore
versions: status: affected
version: edk2-stable202308
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Quarkslab Vulnerability Reports Team
type: remediation developer
user: 00000000-0000-4000-9000-000000000000
value: Doug Flick
descriptions: supportingMedia: base64: no
type: text/html
value:  EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This
 vulnerability can be exploited by an attacker to gain unauthorized 
access and potentially lead to a loss of Availability.


value:  EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This
 vulnerability can be exploited by an attacker to gain unauthorized 
access and potentially lead to a loss of Availability.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-835
description: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
type: CWE
source: discovery: UNKNOWN
title: Infinite loop in EDK II Network Package
x_generator: engine: Vulnogram 0.1.0-dev