EDK II NetworkPkg (IPv6 Destination Options header, PadN option parsing): Same shape as the unknown-option hang but

CVSS 7.5CVE-2023-45233Firmware, BMC & network fabricPixieFailVU#132380curated

Impact

Same shape as the unknown-option hang but reached through the PadN option, which is trivially craftable. One packet parks a node in firmware forever. In a netboot-driven cluster this is a cheap way to deny an operator their fleet during a reprovisioning window, and the failure looks like a hardware fault rather than an attack.

Who can reach it

Unauthenticated, on-link attacker sending crafted IPv6 packets to nodes during network boot.

What to do

Firmware flash from the server OEM, one reboot per node. No runtime fix. Practical interim control is to disable IPv6 network boot in the UEFI setup (a config change, deployable via the OEM's remote BIOS-settings tooling without a flash) and to keep the provisioning VLAN reachable only from the deployment controllers.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-45233 https://kb.cert.org/vuls/id/132380 https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.