EDK II NetworkPkg (PseudoRandom number generation used by the network stack): The weak PRNG behind the previous issue

CVSS 7.5CVE-2023-45237Firmware, BMC & network fabricPixieFailVU#132380curated

Impact

The weak PRNG behind the previous issue - the firmware's randomness source is not random enough for anything security-relevant it feeds, including sequence numbers and transaction identifiers used during netboot. The operator-visible consequence is that boot-time network exchanges are spoofable by an attacker who does not need to see them.

Who can reach it

Off-path or on-path attacker predicting firmware-generated values during network boot. Unauthenticated, pre-OS.

What to do

Firmware flash via the server OEM. Reboot per node. There is nothing to configure - the entropy source is compiled in. Until patched, assume boot-time network exchanges are forgeable and lean on cryptographic verification of the boot payload (signed images, Secure Boot with your own keys) rather than on network trust.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-45237 https://kb.cert.org/vuls/id/132380 https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.