Description
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
TianoCore edk2
Default version status: unaffected
edk2-stable202308affected
References
- https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h ↗
- http://www.openwall.com/lists/oss-security/2024/01/16/2 ↗
- http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html ↗
- https://security.netapp.com/advisory/ntap-20240307-0011/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/ ↗
- https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html ↗
- https://www.kb.cert.org/vuls/id/132380 ↗