EDK II NetworkPkg (TCP initial sequence number generation): The firmware's TCP initial sequence numbers

CVSS 7.5CVE-2023-45236Firmware, BMC & network fabricPixieFailVU#132380curated

Impact

The firmware's TCP initial sequence numbers are predictable, so an off-path attacker can inject into or hijack the boot-time TCP session. In practice that means substituting the payload the node is downloading - the HTTP-boot image, the kernel, the initrd - without ever being on the wire. For a bare-metal GPU cloud that HTTP-boots tenant images, this is a supply-chain swap at provisioning time that no post-boot integrity check will notice if the swapped image is what gets measured.

Who can reach it

Off-path attacker who can guess the ISN - no need to sit on the provisioning segment at all, which makes this materially worse than the on-link PixieFail bugs. Unauthenticated, pre-OS.

What to do

OEM BIOS update; the fix replaces the ISN generator, so there is no configuration toggle that helps. Flash + reboot per node. Compensating control while you wait: use HTTPS boot with proper certificate validation rather than plain HTTP/TFTP, and verify signatures on the downloaded image inside the boot flow rather than relying on transport integrity.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-45236 https://kb.cert.org/vuls/id/132380 https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.