CVE-2023-45232
Publication date 16 January 2024
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
Status
Package | Ubuntu Release | Status |
---|---|---|
edk2 | 24.04 LTS noble |
Not affected
|
22.04 LTS jammy |
Fixed 2022.02-3ubuntu0.22.04.2
|
|
20.04 LTS focal |
Fixed 0~20191122.bd85bf54-2ubuntu3.5
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty | Ignored end of standard support |
Notes
eslerm
shares fixes with CVE-2023-45233 "exposure is limited to PXE boot or HTTP boot" patchset available in bug 4518, but not in repo (until Feb-24) fix and unit test commit id likely 7ec488242f6 and d925ff1f00e
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 · High |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-6638-1
- EDK II vulnerabilities
- 15 February 2024