CVE-2023-45232: Infinite loop in EDK II Network Package

Vulnerability summary

CVE-2023-45232 is a high (CVSS 7.5) Loop with Unreachable Exit Condition vulnerability in tianocore edk2. EPSS estimates a 2.08% chance of exploitation in the next 30 days, higher than 81.5% of scored vulnerabilities.

Timeline

1. 16-01-2024
   PublishedVulnerability first disclosed.
2. 04-11-2025
   Last modifiedVulnerability information updated.

Description

EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.

• CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.