Skip to content
OpenAdvisories
High WID-SEC-2024-0126 9 CVEs

EDK2 NetworkPkg IP stack implementation: Mehrere Schwachstellen

Published Jan 16, 2024 · Updated Jul 9, 2026 · Revision 48 · de-DE

Vendor: amazon Vendor: Debian Vendor: Dell Vendor: Fedora Vendor: HP Vendor: HPE Vendor: Insyde Software Vendor: Lenovo Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: BIOS Product: BIOS Product: Computer Product: Computer Product: Computer Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: PowerEdge Product: ProLiant Product: Rocky Linux Product: Synergy Product: UEFI Firmware

Summary

Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in der EDK2 NetworkPkg IP stack implementation ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen offenzulegen und einen Denial of Service Zustand auszulösen.

Product

InsydeH2O UEFI BIOS ist eine proprietäre, lizenzierte UEFI-BIOS-Firmware, die Intel und AMD basierte Computer unterstützt.

Vulnerabilities 9

  • High 8.3
    CVE-2023-45230

    Buffer Overflow in EDK II Network Package

    EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity …

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • High 8.3
    CVE-2023-45234

    Buffer Overflow in EDK II Network Package

    EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confi…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • High 8.3
    CVE-2023-45235

    Buffer Overflow in EDK II Network Package

    EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Con…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-45232

    Infinite loop in EDK II Network Package

    EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Av…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-45233

    Infinite loop in EDK II Network Package

    EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Avail…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2023-45229

    Out-of-Bounds Read in EDK II Network Package

    EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss…

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2023-45231

    Out-of-Bounds Read in EDK II Network Package

    EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing  Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • Medium 5.8
    CVE-2023-45236

    Predictable TCP ISNs in EDK II Network Package

    EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2023-45237

    Use of a Weak PseudoRandom Number Generator in EDK II Network Package

    EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

    TianoCore EDK2 edk2 edk2 Debian Ubuntu Azure Linux

Revision history

  1. #48

    Neue Updates von Oracle Linux aufgenommen

  2. #47

    Neue Updates von SUSE aufgenommen

  3. #46

    Neue Updates von SUSE aufgenommen

  4. #45

    Neue Updates von HP aufgenommen

  5. #44

    Neue Updates von Ubuntu aufgenommen

  6. #43

    Neue Updates von Ubuntu aufgenommen

  7. #42

    Neue Updates von SUSE aufgenommen

  8. #41

    Neue Updates von SUSE aufgenommen

  9. #40

    Neue Updates von Debian aufgenommen

  10. #39

    Neue Updates von SUSE aufgenommen

  11. #38

    Neue Updates von SUSE aufgenommen

  12. #37

    Neue Updates von SUSE aufgenommen

  13. #36

    Neue Updates von SUSE aufgenommen

  14. #35

    Neue Updates von SUSE und LENOVO aufgenommen

  15. #34

    Neue Updates von SUSE aufgenommen

  16. #33

    Neue Updates von Amazon aufgenommen

  17. #32

    Neue Updates von Oracle Linux aufgenommen

  18. #31

    Neue Updates von HP aufgenommen

  19. #30

    Neue Updates von Red Hat aufgenommen

  20. #29

    Neue Updates von Oracle Linux aufgenommen

  21. #28

    Neue Updates von Oracle Linux aufgenommen

  22. #27

    Neue Updates von Red Hat aufgenommen

  23. #26

    Neue Updates von Red Hat aufgenommen

  24. #25

    Neue Updates von Red Hat aufgenommen

  25. #24

    Neue Updates von Oracle Linux aufgenommen

References