Search for vulnerabilities
Vulnerability details: VCID-5tjt-sq7f-aaaa
Vulnerability ID VCID-5tjt-sq7f-aaaa
Aliases CVE-2023-45232
Summary EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
System Score Found at
cvssv3.1 7.5 http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
ssvc Track http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-45232.json
epss 0.00188 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00188 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00188 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00188 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00267 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00267 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00267 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00267 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00267 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00295 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00497 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00525 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00525 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00525 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.00525 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
epss 0.04115 https://api.first.org/data/v1/epss?cve=CVE-2023-45232
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
ssvc Track https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-45232
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-45232
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20240307-0011/
ssvc Track https://security.netapp.com/advisory/ntap-20240307-0011/
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2024/01/16/2
ssvc Track http://www.openwall.com/lists/oss-security/2024/01/16/2
Reference id Reference type URL
http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-45232.json
https://api.first.org/data/v1/epss?cve=CVE-2023-45232
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45232
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
https://security.netapp.com/advisory/ntap-20240307-0011/
http://www.openwall.com/lists/oss-security/2024/01/16/2
1061256 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061256
2258691 https://bugzilla.redhat.com/show_bug.cgi?id=2258691
cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*
CVE-2023-45232 https://nvd.nist.gov/vuln/detail/CVE-2023-45232
RHSA-2024:2264 https://access.redhat.com/errata/RHSA-2024:2264
RHSA-2024:3017 https://access.redhat.com/errata/RHSA-2024:3017
RHSA-2024:8104 https://access.redhat.com/errata/RHSA-2024:8104
USN-6638-1 https://usn.ubuntu.com/6638-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T18:43:28Z/ Found at http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-45232.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T18:43:28Z/ Found at https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T18:43:28Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-45232
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-45232
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20240307-0011/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T18:43:28Z/ Found at https://security.netapp.com/advisory/ntap-20240307-0011/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2024/01/16/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T18:43:28Z/ Found at http://www.openwall.com/lists/oss-security/2024/01/16/2
Exploit Prediction Scoring System (EPSS)
Percentile 0.41154
EPSS Score 0.00188
Published At April 15, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2024-01-16T20:18:44.621436+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 34.0.0rc2