Description
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This
vulnerability can be exploited by an attacker to gain unauthorized
access and potentially lead to a loss of Availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TianoCore | edk2 | edk2-stable202308 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | edk2 | 2023.11-6 | — |
| Debian 13 | edk2 | 2023.11-6 | — |
| Debian 12 | edk2 | 2022.11-6+deb12u1 | — |
| Debian 11 | edk2 | 2020.11-2+deb11u3 | DLA-4207-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | edk2 | 2022.02-3ubuntu0.22.04.2 | USN-6638-1 |
| Ubuntu 20.04 LTS | edk2 | 0~20191122.bd85bf54-2ubuntu3.5 | USN-6638-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | edk2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | edk2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | edk2 +4 | 20231122-6.el9 | RHSA-2024:2264 |
| RHEL 8 | edk2 +2 | 20220126gitbb1bba3d77-13.el8_10 | RHSA-2024:3017 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.8 EUS | edk2 +2 | 20220126gitbb1bba3d77-4.el8_8.6 | RHSA-2024:8104 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | edk2-ovmf +3 | 20231122-6.el9 | ALSA-2024:2264 |
| AlmaLinux 8 | edk2-ovmf +1 | 20220126gitbb1bba3d77-13.el8_10 | ALSA-2024:3017 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | edk2 | 20231122-6.el9 | RLSA-2024:2264 |
| Rocky Linux 8 | edk2 | 20220126gitbb1bba3d77-13.el8_10 | RLSA-2024:3017 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | ovmf | 202308-150600.5.9.1 | SUSE-SU-2025:0421-1 |
| SLES 15 SP5 | ovmf | 202208-150500.6.6.1 | SUSE-SU-2025:0407-1 |
| SLES 15 SP4 | ovmf | 202202-150400.5.15.1 | SUSE-SU-2025:0503-1 |
| SLES 15 SP3 | ovmf | 202008-150300.10.26.1 | SUSE-SU-2025:0752-1 |
| SLES 12 SP5 | ovmf | 2017+git1510945757.b2662641d5-3.55.1 | SUSE-SU-2026:0196-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | ovmf | 202208-150500.6.6.1 | SUSE-SU-2025:0407-1 |
| SLES for SAP 15 SP4 | ovmf | 202202-150400.5.15.1 | SUSE-SU-2025:0503-1 |
| SLES for SAP 15 SP3 | ovmf | 202008-150300.10.26.1 | SUSE-SU-2025:0752-1 |
| SLE Micro 5.5 | ovmf | 202208-150500.6.6.1 | SUSE-SU-2025:0407-1 |
| SLE Micro 5.4 | ovmf | 202202-150400.5.15.1 | SUSE-SU-2025:0503-1 |
| SLE Micro 5.3 | ovmf | 202202-150400.5.15.1 | SUSE-SU-2025:0503-1 |
| SLE Micro 5.2 | ovmf | 202008-150300.10.26.1 | SUSE-SU-2025:0752-1 |
| SLE Micro 5.1 | ovmf | 202008-150300.10.26.1 | SUSE-SU-2025:0752-1 |
| SLE HPC 15 SP5 | ovmf | 202208-150500.6.6.1 | SUSE-SU-2025:0407-1 |
| SLE HPC 15 SP4 | ovmf | 202202-150400.5.15.1 | SUSE-SU-2025:0503-1 |
| SLE HPC 15 SP3 | ovmf | 202008-150300.10.26.1 | SUSE-SU-2025:0752-1 |
| SUSE Manager Server 4.3 | ovmf | 202202-150400.5.15.1 | SUSE-SU-2025:0503-1 |
| SUSE Manager Proxy 4.3 | ovmf | 202202-150400.5.15.1 | SUSE-SU-2025:0503-1 |
| SUSE Enterprise Storage 7.1 | ovmf | 202008-150300.10.26.1 | SUSE-SU-2025:0752-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ovmf | 202402-1.1 | openSUSE-SU-2024:14199-1 |
| openSUSE Leap 15.6 | ovmf | 202308-150600.5.9.1 | SUSE-SU-2025:0421-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | edk2-ovmf +4 | 20200801stable-1.amzn2.0.4 | ALAS2-2024-2483 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | edk2 | 20240223gitedc6681206c1-1 | — |
| Azure Linux 2 (CBL-Mariner) | edk2 | 20230301gitf80f052277c8-40 | — |
| Azure Linux 2 (CBL-Mariner) | hvloader | 1.0.1-9 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | edk2-ovmf +3 | 20231122-6.0.1.el9 | ELSA-2024-23120, ELSA-2024-12409, ELSA-2024-2264 |
| Oracle Linux 8 | edk2-ovmf +1 | 20220126gitbb1bba3d77-13.el8_10 | ELSA-2024-12343, ELSA-2024-3017 |
| Oracle Linux 8 | edk2-tools | 1:20240227-5.el8 | ELSA-2024-20865 |
| Oracle Linux 7 | OVMF +1 | 1:1.7.0-5.el7 | ELSA-2024-12408 |
Advisories 26
- ALSA-2024:2264 Important: edk2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:3017 Important: edk2 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:2264 Red Hat Security Advisory: edk2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2024-0126 EDK2 NetworkPkg IP stack implementation: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 9, 2026
- RHSA-2024:3017 Red Hat Security Advisory: edk2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- ICSA-26-141-02 ABB B&R PCs CISA ICS & IT advisories · May 21, 2026
- SA24P003 B&R PCs vulnerable to PixieFail attack ABB PSIRT · May 14, 2026
- USN-6638-1 edk2 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2026:0196-1 Security update for ovmf SUSE / openSUSE Security Updates · Mar 23, 2026
- RHSA-2024:8104 Red Hat Security Advisory: edk2 security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- DLA-4207-1 edk2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:2264 Important: edk2 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2025:0503-1 Security update for ovmf SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0421-1 Security update for ovmf SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0752-1 Security update for ovmf SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0407-1 Security update for ovmf SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2024:3017 Important: edk2 security update Rocky Linux Security Advisories · May 7, 2025
- openSUSE-SU-2024:14199-1 ovmf-202402-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ELSA-2024-12408 Important: edk2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 4, 2024
- ELSA-2024-12409 Important: edk2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 3, 2024
- ELSA-2024-23120 Important: edk2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 3, 2024
- ELSA-2024-3017 Important: edk2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 23, 2024
- ELSA-2024-2264 Important: edk2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 3, 2024
- ELSA-2024-20865 Moderate: edk2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 24, 2024
- ELSA-2024-12343 Moderate: edk2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 24, 2024
- ALAS2-2024-2483 Important: edk2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 4, 2024
References
- https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h vendor-advisory
- http://www.openwall.com/lists/oss-security/2024/01/16/2
- http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
- https://security.netapp.com/advisory/ntap-20240307-0011/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/