Buffer overflow in edk2 - CVE-2023-45234

 

Buffer overflow in edk2 - CVE-2023-45234

Published: January 17, 2024


Vulnerability identifier: #VU85525
CSH Severity: Medium
CVSS v4 BT: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-45234
CWE-ID: CWE-119
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing DNS Servers option from a DHCPv6 Advertise message. A remote attacker on the local network can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

edk2
Intel NUC X15 Laptop Kit - LAPAC71G
Intel NUC X15 Laptop Kit - LAPAC71H
Precision 7960 XL Rack
Intel NUC M15 Laptop Kit - LAPBC510
Intel NUC M15 Laptop Kit - LAPBC710
Intel NUC M15 Laptop Kit - LAPRC710
Intel NUC M15 Laptop Kit - LAPRC510
Intel NUC X15 Laptop Kit - LAPKC51E
Intel NUC X15 Laptop Kit - LAPKC71E
Intel NUC X15 Laptop Kit - LAPKC71F
Cray EX255a
PowerEdge C6615
Cray EX420
PowerEdge XE9640
PowerEdge XE8640
PowerEdge XE9680
PowerEdge XR8610t
PowerEdge R960
PowerEdge HS5610
PowerEdge HS5620
PowerEdge R660xs
PowerEdge R760xs
PowerEdge R760xd2
PowerEdge T560
PowerEdge R760xa
PowerEdge XR5610
PowerEdge XR8620t
PowerEdge XR7620
PowerEdge R6615
PowerEdge R7615
Dell XC Core XC660
PowerEdge MX760c
PowerEdge C6620
PowerEdge R760
PowerEdge R660
Dell XC Core XC760
PowerEdge R860
PowerEdge R6625
PowerEdge R7625
Cray EX425
Vostro 15 3530
Vostro 14 3430
Inspiron 15 3530
PowerEdge R350
PowerEdge R250
PowerEdge T150
PowerEdge T350
Cray EX254n
Compute Scale-up Server 3200
Inspiron 14 5430
Inspiron 16 5630
Inspiron 16 7630 2-in-1
Inspiron 14 7430 2-in-1
Vostro 16 5630
Dell EMC XC Core XC750
Dell EMC XC Core XC650
Dell EMC XC Core XC450
Dell EMC XC Core XC6520
Dell EMC XC Core XC750xa
PowerEdge XR12
PowerEdge T550
PowerEdge R650
PowerEdge R750
PowerEdge R750XA
PowerEdge C6520
PowerEdge MX750c
PowerEdge R550
PowerEdge R450
PowerEdge R650XS
PowerEdge R750XS
PowerEdge XR11
XPS 9315 2-in-1
PowerEdge XR4520c
PowerEdge XR4510c
Alienware m16 R1
Alienware m18 R1
Inspiron 24 5415 All-in-One
PowerEdge R830
Vostro 5620
XPS 13 9305
Inspiron 5420
Inspiron 5620
Alienware x15 R1
Alienware x17 R1
Latitude 7330 Rugged Laptop
Latitude 5430 Rugged Laptop
Inspiron 3880
Inspiron 3881
Dell G15 5511
XPS 15 9510
Precision 5560
Alienware m15 R6
Latitude 9420
Cray XD665
Superdome Flex 280 Server
Cray XD670
XPS 8960
Dell SD-WAN EDGE610/610-LTE
Dell SD-WAN EDGE620/640/680
VEP1400 (VEP1425/1445/1485)
PowerEdge R930
Dell EMC XC Core XC7525
PowerEdge R240
Dell EMC NX440
PowerEdge T140
PowerEdge R340
PowerEdge T340
Precision 7910 Rack
Precision 7910 XL Rack
Dell XC630 Hyper-converged Appliance
Dell XC730 Hyper-converged Appliance
Dell XC730XD Hyper-converged Appliance
Dell Storage NX3330
Dell Storage NX3230
PowerEdge R730xd
PowerEdge M830
PowerEdge M830 (for PE VRTX)
PowerEdge FC430
PowerEdge FC630
PowerEdge M630 (for PE VRTX)
PowerEdge M630
PowerEdge C4130
PowerEdge R630
PowerEdge FC830
PowerEdge R730
PowerEdge R430
PowerEdge R530
PowerEdge T630
PowerEdge T430
PowerEdge C6320
Dell XC6320 Hyper-converged Appliance
Dell XC430 Hyper-converged Appliance
Dell Storage NX430
PowerEdge T130
PowerEdge R330
PowerEdge R230
PowerEdge T330
DSS 8440
PowerEdge XE7440
PowerEdge XE2420
PowerEdge XE7420
Dell EMC Storage NX3240
PowerEdge R740XD
PowerEdge R640
PowerEdge R940
PowerEdge R540
PowerEdge R440
PowerEdge T440
PowerEdge XR2
PowerEdge R740XD2
PowerEdge R840
PowerEdge C6420
PowerEdge M640
PowerEdge R940XA
PowerEdge T640
PowerEdge C4140
PowerEdge MX840C
PowerEdge FC640
PowerEdge MX740C
PowerEdge M640 (for PE VRTX)
Dell EMC Storage NX3340
Dell EMC XC Core XC740xd System
Dell EMC XC Core XC740xd2
Dell EMC XC Core XC940 System
Dell EMC XC Core XCXR2
Precision 7920 Rack
Precision 7920 XL Rack
Dell EMC XC Core XC640 System
Dell EMC XC Core 6420 System
PowerEdge R740
HPE ProLiant XL675d Gen10 Plus Server
HPE ProLiant XL645d Gen10 Plus Server
PowerSwitch Z9264F-ON
PowerSwitch N3200-ON Series
PowerSwitch N2200-ON Series
PowerSwitch Z9432F-ON
PowerSwitch S5448F-ON
PowerSwitch E3200-ON Series
Superdome Flex Server
HPC Firmware Pack
Debian Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Server Applications Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
APEX Cloud Platform for Microsoft Azure
Precision 7960 Rack
PowerFlex Appliance
Cray EX235a
PowerFlex rack
Red Hat OpenShift Container Platform
qemu-efi (Ubuntu package)
qemu-efi-arm (Ubuntu package)
qemu-efi-aarch64 (Ubuntu package)
ovmf (Ubuntu package)
qemu-uefi-aarch64
ovmf-tools
ovmf
qemu-ovmf-x86_64
edk2 (Debian package)
efi-shell-arm (Ubuntu package)
efi-shell-aa64 (Ubuntu package)
efi-shell-x64 (Ubuntu package)
edk2-aarch64
edk2
edk2-devel
edk2-debuginfo
edk2-debugsource
python3-edk2-devel
edk2-help
edk2-ovmf
qemu-ovmf-x86_64-debug
qemu-uefi-aarch32
qemu-ovmf-ia32
edk2-tools
edk2-loongarch64
edk2 (Red Hat package)
edk2-tools-doc
Cray EX235n
Cray EX4252
PowerEdge R6415
PowerEdge R7415
PowerEdge R7425
PowerEdge XE8545
PowerEdge C6525
PowerEdge R7525
PowerEdge R7515
PowerEdge R6515
PowerEdge R6525

How to mitigate CVE-2023-45234

Install updates from vendor's website.

edk2 - update to edk2-stable202402
APEX Cloud Platform for Microsoft Azure - update to 01.01.00.00
Red Hat OpenShift Container Platform - update to 4.12.53
Intel NUC X15 Laptop Kit - LAPAC71G - update to ACADL357.0065
Intel NUC X15 Laptop Kit - LAPAC71H - update to ACADL357.0065
Precision 7960 XL Rack - update to BIOS 2.0.0
Precision 7960 Rack - update to BIOS 2.0.0
Intel NUC M15 Laptop Kit - LAPBC510 - update to BCTGL357.0083
Intel NUC M15 Laptop Kit - LAPBC710 - update to BCTGL357.0083
Intel NUC M15 Laptop Kit - LAPRC710 - update to RCADL357.0066
Intel NUC M15 Laptop Kit - LAPRC510 - update to RCADL357.0066
PowerFlex Appliance - update to IC 45.374.00
Intel NUC X15 Laptop Kit - LAPKC51E - update to KCTGL357.0048
Intel NUC X15 Laptop Kit - LAPKC71E - update to KCTGL357.0048
Intel NUC X15 Laptop Kit - LAPKC71F - update to KCTGL357.0048
qemu-efi (Ubuntu package) - addressed in versions 0~20191122.bd85bf54-2ubuntu3.5, 2022.02-3ubuntu0.22.04.2
qemu-efi-arm (Ubuntu package) - addressed in versions 0~20191122.bd85bf54-2ubuntu3.5, 2022.02-3ubuntu0.22.04.2, 2023.05-2ubuntu0.1
qemu-efi-aarch64 (Ubuntu package) - addressed in versions 0~20191122.bd85bf54-2ubuntu3.5, 2022.02-3ubuntu0.22.04.2, 2023.05-2ubuntu0.1
ovmf (Ubuntu package) - addressed in versions 0~20191122.bd85bf54-2ubuntu3.5, 2022.02-3ubuntu0.22.04.2, 2023.05-2ubuntu0.1
Cray EX255a - update to 1.1.1
PowerEdge C6615 - update to 1.1.2
Cray EX420 - update to 1.3.2
PowerEdge XE9640 - update to 1.3.6
PowerEdge XE8640 - update to 1.3.6
PowerEdge XE9680 - update to 1.3.6
Cray EX235n - update to 1.4.0
PowerEdge XR8610t - update to 1.6.6
PowerEdge R960 - update to 1.6.6
PowerEdge HS5610 - update to 1.6.6
PowerEdge HS5620 - update to 1.6.6
PowerEdge R660xs - update to 1.6.6
PowerEdge R760xs - update to 1.6.6
PowerEdge R760xd2 - update to 1.6.6
PowerEdge T560 - update to 1.6.6
PowerEdge R760xa - update to 1.6.6
PowerEdge XR5610 - update to 1.6.6
PowerEdge XR8620t - update to 1.6.6
PowerEdge XR7620 - update to 1.6.6
PowerEdge R6615 - update to 1.6.6
PowerEdge R7615 - update to 1.6.6
Dell XC Core XC660 - update to 1.6.6
PowerEdge MX760c - update to 1.6.6
PowerEdge C6620 - update to 1.6.6
PowerEdge R760 - update to 1.6.6
PowerEdge R660 - update to 1.6.6
Dell XC Core XC760 - update to 1.6.6
PowerEdge R860 - update to 1.6.6
PowerEdge R6625 - update to 1.6.8
PowerEdge R7625 - update to 1.6.8
Cray EX4252 - update to 1.7.0
Cray EX425 - update to 1.7.4
Vostro 15 3530 - update to 1.8.0
Vostro 14 3430 - update to 1.8.0
Inspiron 15 3530 - update to 1.8.0
PowerEdge R350 - update to 1.8.1
PowerEdge R250 - update to 1.8.1
PowerEdge T150 - update to 1.8.1
PowerEdge T350 - update to 1.8.1
Cray EX235a - update to 1.9.0
Cray EX254n - update to 1.9.0
Compute Scale-up Server 3200 - update to 1.10.342
Inspiron 14 5430 - update to 1.11.0
Inspiron 16 5630 - update to 1.11.0
Inspiron 16 7630 2-in-1 - update to 1.11.0
Inspiron 14 7430 2-in-1 - update to 1.11.0
Vostro 16 5630 - update to 1.11.0
Dell EMC XC Core XC750 - update to 1.12.1
Dell EMC XC Core XC650 - update to 1.12.1
Dell EMC XC Core XC450 - update to 1.12.1
Dell EMC XC Core XC6520 - update to 1.12.1
Dell EMC XC Core XC750xa - update to 1.12.1
PowerEdge XR12 - update to 1.12.1
PowerEdge T550 - update to 1.12.1
PowerEdge R650 - update to 1.12.1
PowerEdge R750 - update to 1.12.1
PowerEdge R750XA - update to 1.12.1
PowerEdge C6520 - update to 1.12.1
PowerEdge MX750c - update to 1.12.1
PowerEdge R550 - update to 1.12.1
PowerEdge R450 - update to 1.12.1
PowerEdge R650XS - update to 1.12.1
PowerEdge R750XS - update to 1.12.1
PowerEdge XR11 - update to 1.12.1
XPS 9315 2-in-1 - update to 1.13.0
PowerEdge XR4520c - update to 1.13.3
PowerEdge XR4510c - update to 1.13.3
Alienware m16 R1 - update to 1.14.1
Alienware m18 R1 - update to 1.14.1
Inspiron 24 5415 All-in-One - update to 1.17.0
PowerEdge R830 - update to 1.18.1
Vostro 5620 - update to 1.19.0
XPS 13 9305 - update to 1.19.0
Inspiron 5420 - update to 1.19.0
Inspiron 5620 - update to 1.19.0
PowerEdge R6415 - update to 1.21.0
Alienware x15 R1 - update to 1.21.0
Alienware x17 R1 - update to 1.21.0
PowerEdge R7415 - update to 1.21.0
PowerEdge R7425 - update to 1.21.0
Latitude 7330 Rugged Laptop - update to 1.24.0
Latitude 5430 Rugged Laptop - update to 1.24.0
Inspiron 3880 - update to 1.24.1
Inspiron 3881 - update to 1.24.1
Dell G15 5511 - update to 1.26.0
XPS 15 9510 - update to 1.26.0
Precision 5560 - update to 1.26.0
Alienware m15 R6 - update to 1.27.0
Latitude 9420 - update to 1.27.0
Cray XD665 - update to 1.50
Superdome Flex 280 Server - update to 1.70.14
Cray XD670 - update to 2.01
XPS 8960 - update to 2.3.0
Dell SD-WAN EDGE610/610-LTE - update to 2.6
Dell SD-WAN EDGE620/640/680 - update to 2.6
VEP1400 (VEP1425/1445/1485) - update to 2.6
PowerEdge R930 - update to 2.13.0
PowerEdge XE8545 - update to 2.13.3
PowerEdge C6525 - update to 2.13.3
PowerEdge R7525 - update to 2.13.3
PowerEdge R7515 - update to 2.13.3
PowerEdge R6515 - update to 2.13.3
PowerEdge R6525 - update to 2.13.3
Dell EMC XC Core XC7525 - update to 2.13.3
PowerEdge R240 - update to 2.15.1
Dell EMC NX440 - update to 2.15.1
PowerEdge T140 - update to 2.15.1
PowerEdge R340 - update to 2.15.1
PowerEdge T340 - update to 2.15.1
Precision 7910 Rack - update to 2.18.0
Precision 7910 XL Rack - update to 2.18.0
Dell XC630 Hyper-converged Appliance - update to 2.18.1
Dell XC730 Hyper-converged Appliance - update to 2.18.1
Dell XC730XD Hyper-converged Appliance - update to 2.18.1
Dell Storage NX3330 - update to 2.18.1
Dell Storage NX3230 - update to 2.18.1
PowerEdge R730xd - update to 2.18.1
PowerEdge M830 - update to 2.18.1
PowerEdge M830 (for PE VRTX) - update to 2.18.1
PowerEdge FC430 - update to 2.18.1
PowerEdge FC630 - update to 2.18.1
PowerEdge M630 (for PE VRTX) - update to 2.18.1
PowerEdge M630 - update to 2.18.1
PowerEdge C4130 - update to 2.18.1
PowerEdge R630 - update to 2.18.1
PowerEdge FC830 - update to 2.18.1
PowerEdge R730 - update to 2.18.1
PowerEdge R430 - update to 2.18.2
PowerEdge R530 - update to 2.18.2
PowerEdge T630 - update to 2.18.2
PowerEdge T430 - update to 2.18.2
PowerEdge C6320 - update to 2.18.2
Dell XC6320 Hyper-converged Appliance - update to 2.18.2
Dell XC430 Hyper-converged Appliance - update to 2.18.2
Dell Storage NX430 - update to 2.19.0
PowerEdge T130 - update to 2.19.1
PowerEdge R330 - update to 2.19.1
PowerEdge R230 - update to 2.19.1
PowerEdge T330 - update to 2.19.1
DSS 8440 - update to 2.20.0
PowerEdge XE7440 - update to 2.20.0
PowerEdge XE2420 - update to 2.20.0
PowerEdge XE7420 - update to 2.20.0
Dell EMC Storage NX3240 - update to 2.20.1
PowerEdge R740XD - update to 2.20.1
PowerEdge R640 - update to 2.20.1
PowerEdge R940 - update to 2.20.1
PowerEdge R540 - update to 2.20.1
PowerEdge R440 - update to 2.20.1
PowerEdge T440 - update to 2.20.1
PowerEdge XR2 - update to 2.20.1
PowerEdge R740XD2 - update to 2.20.1
PowerEdge R840 - update to 2.20.1
PowerEdge C6420 - update to 2.20.1
PowerEdge M640 - update to 2.20.1
PowerEdge R940XA - update to 2.20.1
PowerEdge T640 - update to 2.20.1
PowerEdge C4140 - update to 2.20.1
PowerEdge MX840C - update to 2.20.1
PowerEdge FC640 - update to 2.20.1
PowerEdge MX740C - update to 2.20.1
PowerEdge M640 (for PE VRTX) - update to 2.20.1
Dell EMC Storage NX3340 - update to 2.20.1
Dell EMC XC Core XC740xd System - update to 2.20.1
Dell EMC XC Core XC740xd2 - update to 2.20.1
Dell EMC XC Core XC940 System - update to 2.20.1
Dell EMC XC Core XCXR2 - update to 2.20.1
Precision 7920 Rack - update to 2.20.1
Precision 7920 XL Rack - update to 2.20.1
Dell EMC XC Core XC640 System - update to 2.20.1
Dell EMC XC Core 6420 System - update to 2.20.1
PowerEdge R740 - update to 2.20.1
PowerFlex rack - addressed in versions 3.6.6.0, 3.7.4.0
HPE ProLiant XL675d Gen10 Plus Server - update to 3.10
HPE ProLiant XL645d Gen10 Plus Server - update to 3.10
PowerSwitch Z9264F-ON - update to 3.42.5.1-21
PowerSwitch N3200-ON Series - update to 3.45.5.1-31
PowerSwitch N2200-ON Series - update to 3.45.5.1-31
PowerSwitch Z9432F-ON - update to 3.51.5.1-21
PowerSwitch S5448F-ON - update to 3.52.5.1-12
PowerSwitch E3200-ON Series - update to 3.57.5.1-5
Superdome Flex Server - update to 3.90.18
HPC Firmware Pack - addressed in versions 24.8.1, 24.9.0
qemu-uefi-aarch64 - addressed in versions 2017+git1510945757.b2662641d5-3.55.1, 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
ovmf-tools - addressed in versions 2017+git1510945757.b2662641d5-3.55.1, 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
ovmf - addressed in versions 2017+git1510945757.b2662641d5-3.55.1, 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
qemu-ovmf-x86_64 - addressed in versions 2017+git1510945757.b2662641d5-3.55.1, 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
edk2 (Debian package) - addressed in versions 2020.11-2+deb11u2, 2022.11-6+deb12u1
efi-shell-arm (Ubuntu package) - update to 2023.05-2ubuntu0.1
efi-shell-aa64 (Ubuntu package) - update to 2023.05-2ubuntu0.1
efi-shell-x64 (Ubuntu package) - update to 2023.05-2ubuntu0.1
edk2-aarch64 - addressed in versions 202002-19, 202002-20
edk2 - addressed in versions 202002-19, 202002-20
edk2-devel - addressed in versions 202002-19, 202002-20
edk2-debuginfo - addressed in versions 202002-19, 202002-20
edk2-debugsource - addressed in versions 202002-19, 202002-20
python3-edk2-devel - addressed in versions 202002-19, 202002-20
edk2-help - addressed in versions 202002-19, 202002-20
edk2-ovmf - addressed in versions 202002-19, 202002-20
qemu-ovmf-x86_64-debug - addressed in versions 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
qemu-uefi-aarch32 - addressed in versions 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
qemu-ovmf-ia32 - addressed in versions 202008-150300.10.26.1, 202202-150400.5.15.1, 202208-150500.6.6.1, 202308-150600.5.9.1
edk2-tools - update to 202402-4
edk2-ovmf - addressed in versions 202402-4, 20220126gitbb1bba3d77-13.0.1
edk2-loongarch64 - update to 202402-4
edk2-aarch64 - addressed in versions 202402-4, 20220126gitbb1bba3d77-13.0.1
edk2 (Red Hat package) - addressed in versions 20190829git37eef91017ad-9.el8_2.4, 20200602gitca407c7246bf-4.el8_4.5, 20220126gitbb1bba3d77-2.el8_6.4, 20220126gitbb1bba3d77-3.el9_0.4, 20220126gitbb1bba3d77-4.el8_8.3, 20220126gitbb1bba3d77-6.el8_9.6, 20221207gitfff6d81270b5-9.el9_2.2, 20230524-4.el9_3.2
edk2-tools-doc - update to 20220126gitbb1bba3d77-13.0.1

External References

Related Security Bulletins