CVE-2023-45233: Infinite loop in EDK II Network Package

Vulnerability summary

CVE-2023-45233 is a high (CVSS 7.5) Loop with Unreachable Exit Condition vulnerability in tianocore edk2. EPSS estimates a 2.08% chance of exploitation in the next 30 days, higher than 81.5% of scored vulnerabilities.

Timeline

1. 16-01-2024
   PublishedVulnerability first disclosed.
2. 04-11-2025
   Last modifiedVulnerability information updated.

Description

EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.

• CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.