Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in edk2 - CVE-2023-45237

Vulnerability identifier: #VU85528

CSH Severity: Medium

CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-45237

CWE-ID: CWE-338

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a predictable TCP Initial Sequence Number. A remote attacker can gain unauthorized access to sensitive information on the system.

edk2
Intel NUC X15 Laptop Kit - LAPAC71G
Intel NUC X15 Laptop Kit - LAPAC71H
Precision 7960 XL Rack
Intel NUC M15 Laptop Kit - LAPBC510
Intel NUC M15 Laptop Kit - LAPBC710
Intel NUC M15 Laptop Kit - LAPRC510
Intel NUC M15 Laptop Kit - LAPRC710
Intel NUC X15 Laptop Kit - LAPKC71E
Intel NUC X15 Laptop Kit - LAPKC51E
Intel NUC X15 Laptop Kit - LAPKC71F
Cray EX255a
PowerEdge C6615
Cray EX420
PowerEdge XE9680
PowerEdge XE9640
PowerEdge XE8640
PowerEdge R7615
Dell XC Core XC760
Dell XC Core XC660
PowerEdge R6615
PowerEdge XR8620t
PowerEdge R660
PowerEdge R760
PowerEdge C6620
PowerEdge MX760c
PowerEdge R860
PowerEdge R960
PowerEdge HS5610
PowerEdge HS5620
PowerEdge R660xs
PowerEdge R760xs
PowerEdge XR7620
PowerEdge XR8610t
PowerEdge R760xd2
PowerEdge T560
PowerEdge R760xa
PowerEdge XR5610
PowerEdge R7625
PowerEdge R6625
Cray EX425
PowerEdge R250
PowerEdge R350
PowerEdge T350
PowerEdge T150
Cray EX254n
Compute Scale-up Server 3200
Dell EMC XC Core XC650
PowerEdge R550
Dell EMC XC Core XC450
Dell EMC XC Core XC6520
Dell EMC XC Core XC750xa
Dell EMC XC Core XC750
PowerEdge XR12
PowerEdge XR11
PowerEdge T550
PowerEdge R750XS
PowerEdge R650XS
PowerEdge R450
PowerEdge MX750c
PowerEdge C6520
PowerEdge R750XA
PowerEdge R750
PowerEdge R650
PowerEdge XR4520c
PowerEdge XR4510c
PowerEdge R830
Cray XD665
Superdome Flex 280 Server
Cray XD670
VEP1400 (VEP1425/1445/1485)
Dell SD-WAN EDGE620/640/680
Dell SD-WAN EDGE610/610-LTE
PowerEdge R930
Dell EMC XC Core XC7525
Dell EMC NX440
PowerEdge T140
PowerEdge T340
PowerEdge R340
PowerEdge R240
Precision 7910 Rack
Precision 7910 XL Rack
PowerEdge R630
Dell XC630 Hyper-converged Appliance
Dell Storage NX3330
Dell Storage NX3230
Dell XC730 Hyper-converged Appliance
Dell XC730XD Hyper-converged Appliance
PowerEdge R730
PowerEdge R730xd
PowerEdge FC830
PowerEdge M830 (for PE VRTX)
PowerEdge M830
PowerEdge FC430
PowerEdge FC630
PowerEdge M630 (for PE VRTX)
PowerEdge M630
PowerEdge C4130
Dell XC430 Hyper-converged Appliance
Dell XC6320 Hyper-converged Appliance
PowerEdge C6320
PowerEdge T630
PowerEdge R530
PowerEdge R430
PowerEdge T430
Dell Storage NX430
PowerEdge T330
PowerEdge R330
PowerEdge R230
PowerEdge T130
PowerEdge XE7440
PowerEdge XE7420
DSS 8440
PowerEdge XE2420
PowerEdge MX840C
PowerEdge C4140
Precision 7920 XL Rack
Precision 7920 Rack
PowerEdge R740
PowerEdge R740XD
PowerEdge R540
PowerEdge R640
PowerEdge R940
PowerEdge M640
PowerEdge R440
Dell EMC Storage NX3340
PowerEdge M640 (for PE VRTX)
Dell EMC XC Core XCXR2
Dell EMC XC Core XC940 System
Dell EMC XC Core XC740xd2
Dell EMC XC Core XC740xd System
Dell EMC XC Core XC640 System
Dell EMC XC Core 6420 System
PowerEdge R940XA
PowerEdge MX740C
Dell EMC Storage NX3240
PowerEdge R840
PowerEdge R740XD2
PowerEdge XR2
PowerEdge T440
PowerEdge T640
PowerEdge C6420
PowerEdge FC640
HPE ProLiant XL645d Gen10 Plus Server
HPE ProLiant XL675d Gen10 Plus Server
PowerSwitch Z9264F-ON
PowerSwitch N3200-ON Series
PowerSwitch N2200-ON Series
PowerSwitch Z9432F-ON
PowerSwitch S5448F-ON
PowerSwitch E3200-ON Series
Superdome Flex Server
HPC Firmware Pack
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Anolis OS
Server Applications Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
APEX Cloud Platform for Microsoft Azure
Precision 7960 Rack
PowerFlex Appliance
Cray EX235a
PowerFlex rack
Cray EX235n
Cray EX4252
PowerEdge R6415
PowerEdge R7415
PowerEdge R7425
PowerEdge XE8545
PowerEdge C6525
PowerEdge R7525
PowerEdge R7515
PowerEdge R6525
PowerEdge R6515
Red Hat OpenShift Container Platform
edk2 (Ubuntu package)
edk2
edk2-debuginfo
edk2-debugsource
edk2-devel
edk2-aarch64
edk2-help
edk2-ovmf
python3-edk2-devel
ovmf-tools
qemu-ovmf-x86_64-debug
qemu-ovmf-ia32
qemu-uefi-aarch32
ovmf
qemu-ovmf-x86_64
qemu-uefi-aarch64
edk2-tools-doc
edk2-loongarch64
edk2-tools

Install update from vendor's website.

edk2 - update to edk2-stable202402
APEX Cloud Platform for Microsoft Azure - update to 01.01.00.00
Intel NUC X15 Laptop Kit - LAPAC71G - update to ACADL357.0065
Intel NUC X15 Laptop Kit - LAPAC71H - update to ACADL357.0065
Precision 7960 Rack - update to BIOS 2.0.0
Precision 7960 XL Rack - update to BIOS 2.0.0
Intel NUC M15 Laptop Kit - LAPBC510 - update to BCTGL357.0083
Intel NUC M15 Laptop Kit - LAPBC710 - update to BCTGL357.0083
Intel NUC M15 Laptop Kit - LAPRC510 - update to RCADL357.0066
Intel NUC M15 Laptop Kit - LAPRC710 - update to RCADL357.0066
PowerFlex Appliance - update to IC 45.374.00
Intel NUC X15 Laptop Kit - LAPKC71E - update to KCTGL357.0048
Intel NUC X15 Laptop Kit - LAPKC51E - update to KCTGL357.0048
Intel NUC X15 Laptop Kit - LAPKC71F - update to KCTGL357.0048
Cray EX255a - update to 1.1.1
PowerEdge C6615 - update to 1.1.2
Cray EX420 - update to 1.3.2
PowerEdge XE9680 - update to 1.3.6
PowerEdge XE9640 - update to 1.3.6
PowerEdge XE8640 - update to 1.3.6
Cray EX235n - update to 1.4.0
PowerEdge R7615 - update to 1.6.6
Dell XC Core XC760 - update to 1.6.6
Dell XC Core XC660 - update to 1.6.6
PowerEdge R6615 - update to 1.6.6
PowerEdge XR8620t - update to 1.6.6
PowerEdge R660 - update to 1.6.6
PowerEdge R760 - update to 1.6.6
PowerEdge C6620 - update to 1.6.6
PowerEdge MX760c - update to 1.6.6
PowerEdge R860 - update to 1.6.6
PowerEdge R960 - update to 1.6.6
PowerEdge HS5610 - update to 1.6.6
PowerEdge HS5620 - update to 1.6.6
PowerEdge R660xs - update to 1.6.6
PowerEdge R760xs - update to 1.6.6
PowerEdge XR7620 - update to 1.6.6
PowerEdge XR8610t - update to 1.6.6
PowerEdge R760xd2 - update to 1.6.6
PowerEdge T560 - update to 1.6.6
PowerEdge R760xa - update to 1.6.6
PowerEdge XR5610 - update to 1.6.6
PowerEdge R7625 - update to 1.6.8
PowerEdge R6625 - update to 1.6.8
Cray EX4252 - update to 1.7.0
Cray EX425 - update to 1.7.4
PowerEdge R250 - update to 1.8.1
PowerEdge R350 - update to 1.8.1
PowerEdge T350 - update to 1.8.1
PowerEdge T150 - update to 1.8.1
Cray EX235a - update to 1.9.0
Cray EX254n - update to 1.9.0
Compute Scale-up Server 3200 - update to 1.10.342
Dell EMC XC Core XC650 - update to 1.12.1
PowerEdge R550 - update to 1.12.1
Dell EMC XC Core XC450 - update to 1.12.1
Dell EMC XC Core XC6520 - update to 1.12.1
Dell EMC XC Core XC750xa - update to 1.12.1
Dell EMC XC Core XC750 - update to 1.12.1
PowerEdge XR12 - update to 1.12.1
PowerEdge XR11 - update to 1.12.1
PowerEdge T550 - update to 1.12.1
PowerEdge R750XS - update to 1.12.1
PowerEdge R650XS - update to 1.12.1
PowerEdge R450 - update to 1.12.1
PowerEdge MX750c - update to 1.12.1
PowerEdge C6520 - update to 1.12.1
PowerEdge R750XA - update to 1.12.1
PowerEdge R750 - update to 1.12.1
PowerEdge R650 - update to 1.12.1
PowerEdge XR4520c - update to 1.13.3
PowerEdge XR4510c - update to 1.13.3
PowerEdge R830 - update to 1.18.1
PowerEdge R6415 - update to 1.21.0
PowerEdge R7415 - update to 1.21.0
PowerEdge R7425 - update to 1.21.0
Cray XD665 - update to 1.50
Superdome Flex 280 Server - update to 1.70.14
Cray XD670 - update to 2.01
VEP1400 (VEP1425/1445/1485) - update to 2.6
Dell SD-WAN EDGE620/640/680 - update to 2.6
Dell SD-WAN EDGE610/610-LTE - update to 2.6
PowerEdge R930 - update to 2.13.0
Dell EMC XC Core XC7525 - update to 2.13.3
PowerEdge XE8545 - update to 2.13.3
PowerEdge C6525 - update to 2.13.3
PowerEdge R7525 - update to 2.13.3
PowerEdge R7515 - update to 2.13.3
PowerEdge R6525 - update to 2.13.3
PowerEdge R6515 - update to 2.13.3
Dell EMC NX440 - update to 2.15.1
PowerEdge T140 - update to 2.15.1
PowerEdge T340 - update to 2.15.1
PowerEdge R340 - update to 2.15.1
PowerEdge R240 - update to 2.15.1
Precision 7910 Rack - update to 2.18.0
Precision 7910 XL Rack - update to 2.18.0
PowerEdge R630 - update to 2.18.1
Dell XC630 Hyper-converged Appliance - update to 2.18.1
Dell Storage NX3330 - update to 2.18.1
Dell Storage NX3230 - update to 2.18.1
Dell XC730 Hyper-converged Appliance - update to 2.18.1
Dell XC730XD Hyper-converged Appliance - update to 2.18.1
PowerEdge R730 - update to 2.18.1
PowerEdge R730xd - update to 2.18.1
PowerEdge FC830 - update to 2.18.1
PowerEdge M830 (for PE VRTX) - update to 2.18.1
PowerEdge M830 - update to 2.18.1
PowerEdge FC430 - update to 2.18.1
PowerEdge FC630 - update to 2.18.1
PowerEdge M630 (for PE VRTX) - update to 2.18.1
PowerEdge M630 - update to 2.18.1
PowerEdge C4130 - update to 2.18.1
Dell XC430 Hyper-converged Appliance - update to 2.18.2
Dell XC6320 Hyper-converged Appliance - update to 2.18.2
PowerEdge C6320 - update to 2.18.2
PowerEdge T630 - update to 2.18.2
PowerEdge R530 - update to 2.18.2
PowerEdge R430 - update to 2.18.2
PowerEdge T430 - update to 2.18.2
Dell Storage NX430 - update to 2.19.0
PowerEdge T330 - update to 2.19.1
PowerEdge R330 - update to 2.19.1
PowerEdge R230 - update to 2.19.1
PowerEdge T130 - update to 2.19.1
PowerEdge XE7440 - update to 2.20.0
PowerEdge XE7420 - update to 2.20.0
DSS 8440 - update to 2.20.0
PowerEdge XE2420 - update to 2.20.0
PowerEdge MX840C - update to 2.20.1
PowerEdge C4140 - update to 2.20.1
Precision 7920 XL Rack - update to 2.20.1
Precision 7920 Rack - update to 2.20.1
PowerEdge R740 - update to 2.20.1
PowerEdge R740XD - update to 2.20.1
PowerEdge R540 - update to 2.20.1
PowerEdge R640 - update to 2.20.1
PowerEdge R940 - update to 2.20.1
PowerEdge M640 - update to 2.20.1
PowerEdge R440 - update to 2.20.1
Dell EMC Storage NX3340 - update to 2.20.1
PowerEdge M640 (for PE VRTX) - update to 2.20.1
Dell EMC XC Core XCXR2 - update to 2.20.1
Dell EMC XC Core XC940 System - update to 2.20.1
Dell EMC XC Core XC740xd2 - update to 2.20.1
Dell EMC XC Core XC740xd System - update to 2.20.1
Dell EMC XC Core XC640 System - update to 2.20.1
Dell EMC XC Core 6420 System - update to 2.20.1
PowerEdge R940XA - update to 2.20.1
PowerEdge MX740C - update to 2.20.1
Dell EMC Storage NX3240 - update to 2.20.1
PowerEdge R840 - update to 2.20.1
PowerEdge R740XD2 - update to 2.20.1
PowerEdge XR2 - update to 2.20.1
PowerEdge T440 - update to 2.20.1
PowerEdge T640 - update to 2.20.1
PowerEdge C6420 - update to 2.20.1
PowerEdge FC640 - update to 2.20.1
PowerFlex rack - addressed in versions 3.6.6.0, 3.7.4.0
HPE ProLiant XL645d Gen10 Plus Server - update to 3.10
HPE ProLiant XL675d Gen10 Plus Server - update to 3.10
PowerSwitch Z9264F-ON - update to 3.42.5.1-21
PowerSwitch N3200-ON Series - update to 3.45.5.1-31
PowerSwitch N2200-ON Series - update to 3.45.5.1-31
PowerSwitch Z9432F-ON - update to 3.51.5.1-21
PowerSwitch S5448F-ON - update to 3.52.5.1-12
PowerSwitch E3200-ON Series - update to 3.57.5.1-5
Superdome Flex Server - update to 3.90.18
Red Hat OpenShift Container Platform - addressed in versions 4.12.61, 4.13.45, 4.14.33, 4.16.3
HPC Firmware Pack - addressed in versions 24.8.1, 24.9.0
edk2 (Ubuntu package) - addressed in versions 2022.02-3ubuntu0.22.04.4, 2022.02-3ubuntu0.22.04.5, 2024.02-2ubuntu0.6, 2024.02-2ubuntu0.7, 2025.02-3ubuntu2.2
edk2 - update to 202011-22
edk2-debuginfo - update to 202011-22
edk2-debugsource - update to 202011-22
edk2-devel - update to 202011-22
edk2-aarch64 - update to 202011-22
edk2-help - update to 202011-22
edk2-ovmf - update to 202011-22
python3-edk2-devel - update to 202011-22
ovmf-tools - addressed in versions 202202-150400.5.15.1, 202202-150400.5.18.1, 202208-150500.6.6.1, 202208-150500.6.9.1, 202308-150600.5.9.1, 202308-150600.5.14.1
qemu-ovmf-x86_64-debug - addressed in versions 202202-150400.5.15.1, 202202-150400.5.18.1, 202208-150500.6.6.1, 202208-150500.6.9.1, 202308-150600.5.9.1, 202308-150600.5.14.1
qemu-ovmf-ia32 - addressed in versions 202202-150400.5.15.1, 202202-150400.5.18.1, 202208-150500.6.6.1, 202208-150500.6.9.1, 202308-150600.5.9.1, 202308-150600.5.14.1
qemu-uefi-aarch32 - addressed in versions 202202-150400.5.15.1, 202202-150400.5.18.1, 202208-150500.6.6.1, 202208-150500.6.9.1, 202308-150600.5.9.1, 202308-150600.5.14.1
ovmf - addressed in versions 202202-150400.5.15.1, 202202-150400.5.18.1, 202208-150500.6.6.1, 202208-150500.6.9.1, 202308-150600.5.9.1, 202308-150600.5.14.1
qemu-ovmf-x86_64 - addressed in versions 202202-150400.5.15.1, 202202-150400.5.18.1, 202208-150500.6.6.1, 202208-150500.6.9.1, 202308-150600.5.9.1, 202308-150600.5.14.1
qemu-uefi-aarch64 - addressed in versions 202202-150400.5.15.1, 202202-150400.5.18.1, 202208-150500.6.6.1, 202208-150500.6.9.1, 202308-150600.5.9.1, 202308-150600.5.14.1
edk2-tools-doc - addressed in versions 202402-5, 20220126gitbb1bba3d77-13.0.1
edk2-ovmf - addressed in versions 202402-5, 20220126gitbb1bba3d77-13.0.1
edk2-loongarch64 - update to 202402-5
edk2-aarch64 - addressed in versions 202402-5, 20220126gitbb1bba3d77-13.0.1
edk2-tools - update to 202402-5

• https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
• http://www.openwall.com/lists/oss-security/2024/01/16/2

• Multiple vulnerabilities in EDK2
• Multiple vulnerabilities in HPE Superdome Flex, Superdome Flex 280 and Compute Scale-up Server 3200 servers
• Dell Precision Rack servers update for Tianocore EDK2
• Dell PowerEdge Server BIOS update for TianoCore EDK2
• Dell Precision Rack servers update for Tianocore EDK2
• Multiple vulnerabilities in Dell APEX Cloud Platform for Microsoft Azure
• Multiple vulnerabilities in Dell PowerFlex Appliance
• Multiple vulnerabilities in Dell PowerFlex Rack
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Dell PowerFlex Rack
• Multiple vulnerabilities in Intel NUC BIOS firmware
• openEuler update for edk2
• HPE Cray Servers update for BIOS
• SUSE update for ovmf
• SUSE update for ovmf
• SUSE update for ovmf
• SUSE update for ovmf
• SUSE update for ovmf
• SUSE update for ovmf
• Anolis OS update for edk2
• Anolis OS update for edk2
• Dell Networking products update for Tianocore EDK2
• Ubuntu update for edk2
• Ubuntu update for edk2