Infinite loop in edk2 - CVE-2023-45233

Vulnerability identifier: #VU85523

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-45233

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when parsing a PadN option in the Destination Options header of IPv6. A remote attacker can consume all available system resources and cause denial of service conditions.

edk2
Intel NUC X15 Laptop Kit - LAPAC71G
Intel NUC X15 Laptop Kit - LAPAC71H
Precision 7960 XL Rack
Intel NUC M15 Laptop Kit - LAPBC510
Intel NUC M15 Laptop Kit - LAPBC710
Intel NUC M15 Laptop Kit - LAPRC710
Intel NUC M15 Laptop Kit - LAPRC510
Intel NUC X15 Laptop Kit - LAPKC51E
Intel NUC X15 Laptop Kit - LAPKC71E
Intel NUC X15 Laptop Kit - LAPKC71F
Cray EX255a
PowerEdge C6615
Cray EX420
PowerEdge XE9640
PowerEdge XE8640
PowerEdge XE9680
PowerEdge R960
PowerEdge HS5610
PowerEdge HS5620
PowerEdge R660xs
PowerEdge R760xs
PowerEdge R760xd2
Dell XC Core XC660
PowerEdge T560
PowerEdge R760xa
PowerEdge XR5610
PowerEdge XR8610t
PowerEdge XR8620t
PowerEdge XR7620
PowerEdge R6615
PowerEdge R7615
Dell XC Core XC760
PowerEdge MX760c
PowerEdge C6620
PowerEdge R760
PowerEdge R660
PowerEdge R860
PowerEdge R7625
PowerEdge R6625
Cray EX425
Inspiron 15 3530
Vostro 15 3530
Vostro 14 3430
PowerEdge R250
PowerEdge R350
PowerEdge T350
PowerEdge T150
Cray EX254n
Compute Scale-up Server 3200
Inspiron 14 5430
Inspiron 14 7430 2-in-1
Inspiron 16 5630
Inspiron 16 7630 2-in-1
Vostro 16 5630
Dell EMC XC Core XC650
Dell EMC XC Core XC6520
Dell EMC XC Core XC750xa
Dell EMC XC Core XC750
PowerEdge XR12
PowerEdge XR11
PowerEdge R750XS
PowerEdge T550
PowerEdge R650XS
PowerEdge R450
PowerEdge R550
PowerEdge MX750c
Dell EMC XC Core XC450
PowerEdge C6520
PowerEdge R750XA
PowerEdge R750
PowerEdge R650
XPS 9315 2-in-1
PowerEdge XR4510c
PowerEdge XR4520c
Alienware m16 R1
Alienware m18 R1
Inspiron 24 5415 All-in-One
PowerEdge R830
Inspiron 5620
XPS 13 9305
Vostro 5620
Inspiron 5420
Alienware x17 R1
Alienware x15 R1
Latitude 5430 Rugged Laptop
Latitude 7330 Rugged Laptop
Inspiron 3880
Inspiron 3881
Dell G15 5511
XPS 15 9510
Precision 5560
Alienware m15 R6
Latitude 9420
Cray XD665
Superdome Flex 280 Server
Cray XD670
XPS 8960
VEP1400 (VEP1425/1445/1485)
Dell SD-WAN EDGE620/640/680
Dell SD-WAN EDGE610/610-LTE
PowerEdge R930
Dell EMC XC Core XC7525
PowerEdge R340
PowerEdge R240
Dell EMC NX440
PowerEdge T340
PowerEdge T140
Precision 7910 XL Rack
Precision 7910 Rack
Dell XC630 Hyper-converged Appliance
Dell XC730 Hyper-converged Appliance
Dell XC730XD Hyper-converged Appliance
Dell Storage NX3330
PowerEdge R630
Dell Storage NX3230
PowerEdge C4130
PowerEdge R730xd
PowerEdge M630
PowerEdge M630 (for PE VRTX)
PowerEdge FC630
PowerEdge R730
PowerEdge FC430
PowerEdge M830
PowerEdge M830 (for PE VRTX)
PowerEdge FC830
PowerEdge R530
Dell XC430 Hyper-converged Appliance
Dell XC6320 Hyper-converged Appliance
PowerEdge T630
PowerEdge R430
PowerEdge T430
PowerEdge C6320
Dell Storage NX430
PowerEdge R330
PowerEdge T130
PowerEdge R230
PowerEdge T330
DSS 8440
PowerEdge XE2420
PowerEdge XE7420
PowerEdge XE7440
Dell EMC XC Core XC940 System
PowerEdge T640
Dell EMC XC Core XC740xd2
Dell EMC XC Core XC740xd System
Dell EMC XC Core XC640 System
Dell EMC XC Core 6420 System
Dell EMC Storage NX3340
Dell EMC Storage NX3240
PowerEdge C4140
PowerEdge MX840C
PowerEdge MX740C
PowerEdge M640 (for PE VRTX)
PowerEdge M640
PowerEdge FC640
PowerEdge C6420
Precision 7920 Rack
PowerEdge R940XA
PowerEdge R840
PowerEdge R740XD2
PowerEdge XR2
PowerEdge T440
PowerEdge R440
PowerEdge R540
PowerEdge R940
PowerEdge R640
PowerEdge R740XD
PowerEdge R740
Precision 7920 XL Rack
Dell EMC XC Core XCXR2
HPE ProLiant XL675d Gen10 Plus Server
HPE ProLiant XL645d Gen10 Plus Server
PowerSwitch Z9264F-ON
PowerSwitch N3200-ON Series
PowerSwitch N2200-ON Series
PowerSwitch Z9432F-ON
PowerSwitch S5448F-ON
PowerSwitch E3200-ON Series
Superdome Flex Server
HPC Firmware Pack
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE Package Hub 15
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
APEX Cloud Platform for Microsoft Azure
Precision 7960 Rack
PowerFlex Appliance
Cray EX235a
PowerFlex rack
qemu-efi (Ubuntu package)
ovmf (Ubuntu package)
qemu-efi-arm (Ubuntu package)
qemu-efi-aarch64 (Ubuntu package)
qemu-ovmf-x86_64
ovmf
ovmf-tools
qemu-uefi-aarch64
edk2 (Debian package)
efi-shell-aa64 (Ubuntu package)
efi-shell-arm (Ubuntu package)
efi-shell-x64 (Ubuntu package)
edk2-ovmf
edk2-help
python3-edk2-devel
edk2-aarch64
edk2-debugsource
edk2-debuginfo
edk2-devel
edk2
qemu-ovmf-x86_64-debug
qemu-uefi-aarch32
qemu-ovmf-ia32
edk2-loongarch64
edk2-tools
edk2 (Red Hat package)
edk2-tools-doc
Cray EX235n
Cray EX4252
PowerEdge R7425
PowerEdge R7415
PowerEdge R6415
PowerEdge R7515
PowerEdge XE8545
PowerEdge C6525
PowerEdge R7525
PowerEdge R6515
PowerEdge R6525

Install updates from vendor's website.

edk2 - update to edk2-stable202402
APEX Cloud Platform for Microsoft Azure - update to 01.01.00.00
Intel NUC X15 Laptop Kit - LAPAC71G - update to ACADL357.0065
Intel NUC X15 Laptop Kit - LAPAC71H - update to ACADL357.0065
Precision 7960 XL Rack - update to BIOS 2.0.0
Precision 7960 Rack - update to BIOS 2.0.0
Intel NUC M15 Laptop Kit - LAPBC510 - update to BCTGL357.0083
Intel NUC M15 Laptop Kit - LAPBC710 - update to BCTGL357.0083
Intel NUC M15 Laptop Kit - LAPRC710 - update to RCADL357.0066
Intel NUC M15 Laptop Kit - LAPRC510 - update to RCADL357.0066
PowerFlex Appliance - update to IC 45.374.00
Intel NUC X15 Laptop Kit - LAPKC51E - update to KCTGL357.0048
Intel NUC X15 Laptop Kit - LAPKC71E - update to KCTGL357.0048
Intel NUC X15 Laptop Kit - LAPKC71F - update to KCTGL357.0048
qemu-efi (Ubuntu package) - addressed in versions 0~20191122.bd85bf54-2ubuntu3.5, 2022.02-3ubuntu0.22.04.2
ovmf (Ubuntu package) - addressed in versions 0~20191122.bd85bf54-2ubuntu3.5, 2022.02-3ubuntu0.22.04.2, 2023.05-2ubuntu0.1
qemu-efi-arm (Ubuntu package) - addressed in versions 0~20191122.bd85bf54-2ubuntu3.5, 2022.02-3ubuntu0.22.04.2, 2023.05-2ubuntu0.1
qemu-efi-aarch64 (Ubuntu package) - addressed in versions 0~20191122.bd85bf54-2ubuntu3.5, 2022.02-3ubuntu0.22.04.2, 2023.05-2ubuntu0.1
Cray EX255a - update to 1.1.1
PowerEdge C6615 - update to 1.1.2
Cray EX420 - update to 1.3.2
PowerEdge XE9640 - update to 1.3.6
PowerEdge XE8640 - update to 1.3.6
PowerEdge XE9680 - update to 1.3.6
Cray EX235n - update to 1.4.0
PowerEdge R960 - update to 1.6.6
PowerEdge HS5610 - update to 1.6.6
PowerEdge HS5620 - update to 1.6.6
PowerEdge R660xs - update to 1.6.6
PowerEdge R760xs - update to 1.6.6
PowerEdge R760xd2 - update to 1.6.6
Dell XC Core XC660 - update to 1.6.6
PowerEdge T560 - update to 1.6.6
PowerEdge R760xa - update to 1.6.6
PowerEdge XR5610 - update to 1.6.6
PowerEdge XR8610t - update to 1.6.6
PowerEdge XR8620t - update to 1.6.6
PowerEdge XR7620 - update to 1.6.6
PowerEdge R6615 - update to 1.6.6
PowerEdge R7615 - update to 1.6.6
Dell XC Core XC760 - update to 1.6.6
PowerEdge MX760c - update to 1.6.6
PowerEdge C6620 - update to 1.6.6
PowerEdge R760 - update to 1.6.6
PowerEdge R660 - update to 1.6.6
PowerEdge R860 - update to 1.6.6
PowerEdge R7625 - update to 1.6.8
PowerEdge R6625 - update to 1.6.8
Cray EX4252 - update to 1.7.0
Cray EX425 - update to 1.7.4
Inspiron 15 3530 - update to 1.8.0
Vostro 15 3530 - update to 1.8.0
Vostro 14 3430 - update to 1.8.0
PowerEdge R250 - update to 1.8.1
PowerEdge R350 - update to 1.8.1
PowerEdge T350 - update to 1.8.1
PowerEdge T150 - update to 1.8.1
Cray EX254n - update to 1.9.0
Cray EX235a - update to 1.9.0
Compute Scale-up Server 3200 - update to 1.10.342
Inspiron 14 5430 - update to 1.11.0
Inspiron 14 7430 2-in-1 - update to 1.11.0
Inspiron 16 5630 - update to 1.11.0
Inspiron 16 7630 2-in-1 - update to 1.11.0
Vostro 16 5630 - update to 1.11.0
Dell EMC XC Core XC650 - update to 1.12.1
Dell EMC XC Core XC6520 - update to 1.12.1
Dell EMC XC Core XC750xa - update to 1.12.1
Dell EMC XC Core XC750 - update to 1.12.1
PowerEdge XR12 - update to 1.12.1
PowerEdge XR11 - update to 1.12.1
PowerEdge R750XS - update to 1.12.1
PowerEdge T550 - update to 1.12.1
PowerEdge R650XS - update to 1.12.1
PowerEdge R450 - update to 1.12.1
PowerEdge R550 - update to 1.12.1
PowerEdge MX750c - update to 1.12.1
Dell EMC XC Core XC450 - update to 1.12.1
PowerEdge C6520 - update to 1.12.1
PowerEdge R750XA - update to 1.12.1
PowerEdge R750 - update to 1.12.1
PowerEdge R650 - update to 1.12.1
XPS 9315 2-in-1 - update to 1.13.0
PowerEdge XR4510c - update to 1.13.3
PowerEdge XR4520c - update to 1.13.3
Alienware m16 R1 - update to 1.14.1
Alienware m18 R1 - update to 1.14.1
Inspiron 24 5415 All-in-One - update to 1.17.0
PowerEdge R830 - update to 1.18.1
Inspiron 5620 - update to 1.19.0
XPS 13 9305 - update to 1.19.0
Vostro 5620 - update to 1.19.0
Inspiron 5420 - update to 1.19.0
PowerEdge R7425 - update to 1.21.0
Alienware x17 R1 - update to 1.21.0
PowerEdge R7415 - update to 1.21.0
Alienware x15 R1 - update to 1.21.0
PowerEdge R6415 - update to 1.21.0
Latitude 5430 Rugged Laptop - update to 1.24.0
Latitude 7330 Rugged Laptop - update to 1.24.0
Inspiron 3880 - update to 1.24.1
Inspiron 3881 - update to 1.24.1
Dell G15 5511 - update to 1.26.0
XPS 15 9510 - update to 1.26.0
Precision 5560 - update to 1.26.0
Alienware m15 R6 - update to 1.27.0
Latitude 9420 - update to 1.27.0
Cray XD665 - update to 1.50
Superdome Flex 280 Server - update to 1.70.14
Cray XD670 - update to 2.01
XPS 8960 - update to 2.3.0
VEP1400 (VEP1425/1445/1485) - update to 2.6
Dell SD-WAN EDGE620/640/680 - update to 2.6
Dell SD-WAN EDGE610/610-LTE - update to 2.6
PowerEdge R930 - update to 2.13.0
Dell EMC XC Core XC7525 - update to 2.13.3
PowerEdge R7515 - update to 2.13.3
PowerEdge XE8545 - update to 2.13.3
PowerEdge C6525 - update to 2.13.3
PowerEdge R7525 - update to 2.13.3
PowerEdge R6515 - update to 2.13.3
PowerEdge R6525 - update to 2.13.3
PowerEdge R340 - update to 2.15.1
PowerEdge R240 - update to 2.15.1
Dell EMC NX440 - update to 2.15.1
PowerEdge T340 - update to 2.15.1
PowerEdge T140 - update to 2.15.1
Precision 7910 XL Rack - update to 2.18.0
Precision 7910 Rack - update to 2.18.0
Dell XC630 Hyper-converged Appliance - update to 2.18.1
Dell XC730 Hyper-converged Appliance - update to 2.18.1
Dell XC730XD Hyper-converged Appliance - update to 2.18.1
Dell Storage NX3330 - update to 2.18.1
PowerEdge R630 - update to 2.18.1
Dell Storage NX3230 - update to 2.18.1
PowerEdge C4130 - update to 2.18.1
PowerEdge R730xd - update to 2.18.1
PowerEdge M630 - update to 2.18.1
PowerEdge M630 (for PE VRTX) - update to 2.18.1
PowerEdge FC630 - update to 2.18.1
PowerEdge R730 - update to 2.18.1
PowerEdge FC430 - update to 2.18.1
PowerEdge M830 - update to 2.18.1
PowerEdge M830 (for PE VRTX) - update to 2.18.1
PowerEdge FC830 - update to 2.18.1
PowerEdge R530 - update to 2.18.2
Dell XC430 Hyper-converged Appliance - update to 2.18.2
Dell XC6320 Hyper-converged Appliance - update to 2.18.2
PowerEdge T630 - update to 2.18.2
PowerEdge R430 - update to 2.18.2
PowerEdge T430 - update to 2.18.2
PowerEdge C6320 - update to 2.18.2
Dell Storage NX430 - update to 2.19.0
PowerEdge R330 - update to 2.19.1
PowerEdge T130 - update to 2.19.1
PowerEdge R230 - update to 2.19.1
PowerEdge T330 - update to 2.19.1
DSS 8440 - update to 2.20.0
PowerEdge XE2420 - update to 2.20.0
PowerEdge XE7420 - update to 2.20.0
PowerEdge XE7440 - update to 2.20.0
Dell EMC XC Core XC940 System - update to 2.20.1
PowerEdge T640 - update to 2.20.1
Dell EMC XC Core XC740xd2 - update to 2.20.1
Dell EMC XC Core XC740xd System - update to 2.20.1
Dell EMC XC Core XC640 System - update to 2.20.1
Dell EMC XC Core 6420 System - update to 2.20.1
Dell EMC Storage NX3340 - update to 2.20.1
Dell EMC Storage NX3240 - update to 2.20.1
PowerEdge C4140 - update to 2.20.1
PowerEdge MX840C - update to 2.20.1
PowerEdge MX740C - update to 2.20.1
PowerEdge M640 (for PE VRTX) - update to 2.20.1
PowerEdge M640 - update to 2.20.1
PowerEdge FC640 - update to 2.20.1
PowerEdge C6420 - update to 2.20.1
Precision 7920 Rack - update to 2.20.1
PowerEdge R940XA - update to 2.20.1
PowerEdge R840 - update to 2.20.1
PowerEdge R740XD2 - update to 2.20.1
PowerEdge XR2 - update to 2.20.1
PowerEdge T440 - update to 2.20.1
PowerEdge R440 - update to 2.20.1
PowerEdge R540 - update to 2.20.1
PowerEdge R940 - update to 2.20.1
PowerEdge R640 - update to 2.20.1
PowerEdge R740XD - update to 2.20.1
PowerEdge R740 - update to 2.20.1
Precision 7920 XL Rack - update to 2.20.1
Dell EMC XC Core XCXR2 - update to 2.20.1
PowerFlex rack - addressed in versions 3.6.6.0, 3.7.4.0
HPE ProLiant XL675d Gen10 Plus Server - update to 3.10
HPE ProLiant XL645d Gen10 Plus Server - update to 3.10
PowerSwitch Z9264F-ON - update to 3.42.5.1-21
PowerSwitch N3200-ON Series - update to 3.45.5.1-31
PowerSwitch N2200-ON Series - update to 3.45.5.1-31
PowerSwitch Z9432F-ON - update to 3.51.5.1-21
PowerSwitch S5448F-ON - update to 3.52.5.1-12
PowerSwitch E3200-ON Series - update to 3.57.5.1-5
Superdome Flex Server - update to 3.90.18
HPC Firmware Pack - addressed in versions 24.8.1, 24.9.0
qemu-ovmf-x86_64 - addressed in versions 2017+git1510945757.b2662641d5-3.55.1, 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
ovmf - addressed in versions 2017+git1510945757.b2662641d5-3.55.1, 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
ovmf-tools - addressed in versions 2017+git1510945757.b2662641d5-3.55.1, 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
qemu-uefi-aarch64 - addressed in versions 2017+git1510945757.b2662641d5-3.55.1, 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
edk2 (Debian package) - addressed in versions 2020.11-2+deb11u2, 2022.11-6+deb12u1
efi-shell-aa64 (Ubuntu package) - update to 2023.05-2ubuntu0.1
efi-shell-arm (Ubuntu package) - update to 2023.05-2ubuntu0.1
efi-shell-x64 (Ubuntu package) - update to 2023.05-2ubuntu0.1
edk2-ovmf - addressed in versions 202002-19, 202002-20, 202011-16
edk2-help - addressed in versions 202002-19, 202002-20, 202011-16
python3-edk2-devel - addressed in versions 202002-19, 202002-20, 202011-16
edk2-aarch64 - addressed in versions 202002-19, 202002-20, 202011-16
edk2-debugsource - addressed in versions 202002-19, 202002-20, 202011-16
edk2-debuginfo - addressed in versions 202002-19, 202002-20, 202011-16
edk2-devel - addressed in versions 202002-19, 202002-20, 202011-16
edk2 - addressed in versions 202002-19, 202002-20, 202011-16
qemu-ovmf-x86_64-debug - addressed in versions 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
qemu-uefi-aarch32 - addressed in versions 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
qemu-ovmf-ia32 - addressed in versions 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
edk2-ovmf - addressed in versions 202402-4, 20220126gitbb1bba3d77-13.0.1
edk2-loongarch64 - update to 202402-4
edk2-aarch64 - addressed in versions 202402-4, 20220126gitbb1bba3d77-13.0.1
edk2-tools - update to 202402-4
edk2 (Red Hat package) - addressed in versions 20220126gitbb1bba3d77-4.el8_8.6, 20220126gitbb1bba3d77-13.el8_10, 20231122-6.el9
edk2-tools-doc - update to 20220126gitbb1bba3d77-13.0.1

• https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
• http://www.openwall.com/lists/oss-security/2024/01/16/2

• Multiple vulnerabilities in EDK2
• Multiple vulnerabilities in HPE Superdome Flex, Superdome Flex 280 and Compute Scale-up Server 3200 servers
• Dell Precision Rack servers update for Tianocore EDK2
• Dell Client BIOS update for Tianocore EDK2
• Dell PowerEdge Server BIOS update for TianoCore EDK2
• Dell Precision Rack servers update for Tianocore EDK2
• openEuler 20.03 LTS SP1 update for edk2
• openEuler 20.03 LTS SP4 update for edk2
• openEuler 22.03 LTS update for edk2
• openEuler 22.03 LTS SP1 update for edk2
• openEuler 22.03 LTS SP2 update for edk2
• openEuler 22.03 LTS SP3 update for edk2
• Red Hat Enterprise Linux 9 update for edk2
• Multiple vulnerabilities in Dell APEX Cloud Platform for Microsoft Azure
• Multiple vulnerabilities in Dell PowerFlex Appliance
• Multiple vulnerabilities in Dell PowerFlex Rack
• Multiple vulnerabilities in Dell PowerFlex Rack
• Debian update for edk2
• Ubuntu update for edk2
• Red Hat Enterprise Linux 8 update for edk2
• Multiple vulnerabilities in Intel NUC BIOS firmware
• Red Hat Enterprise Linux 8 update for edk2
• HPE Cray Servers update for BIOS
• SUSE update for ovmf
• SUSE update for ovmf
• SUSE update for ovmf
• SUSE update for ovmf
• Anolis OS update for edk2
• Anolis OS update for edk2
• Dell Networking products update for Tianocore EDK2
• SUSE update for ovmf