CVE-2023-45232CWE-835
Infinite loop in EDK II Network Package
High · published January 16, 2024
What it is
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This
vulnerability can be exploited by an attacker to gain unauthorized
access and potentially lead to a loss of Availability.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.02084 · 81.4th percentile
- Weakness
- CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
- Published
- 2024-01-16T16:12Z
EPSS history
Timeline