CVE-2023-45237

EUVD-2023-49543
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This
 vulnerability can be exploited by an attacker to gain unauthorized 
access and potentially lead to a loss of Confidentiality.
PRNG
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 60.2%
Affected Products (NVD)
VendorProductVersion
tianocoreedk2
𝑥
≤ 202311
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
edk2
bookworm
no-dsa
bookworm (security)
vulnerable
bullseye
no-dsa
bullseye (security)
vulnerable
buster
no-dsa
sid
vulnerable
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
edk2
bionic
ignored
focal
ignored
jammy
ignored
lunar
ignored
mantic
ignored
noble
ignored
oracular
ignored
plucky
not-affected
questing
not-affected
trusty
ignored
xenial
ignored
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
ovmf-202202
suse enterprise sap 15 SP4
150400.5.18.1
fixed
suse enterprise server 15 SP4
150400.5.18.1
fixed
ovmf-202208
suse enterprise sap 15 SP5
150500.6.9.1
fixed
suse enterprise server 15 SP5
150500.6.9.1
fixed
ovmf-202308
suse enterprise sap 15 SP6
150600.5.14.1
fixed
suse enterprise server 15 SP6
150600.5.14.1
fixed
ovmf-202408
suse enterprise sap 15 SP7
150700.1.3
fixed
suse enterprise server 15 SP7
150700.1.3
fixed
ovmf-tools-202202
suse enterprise sap 15 SP4
150400.5.18.1
fixed
suse enterprise server 15 SP4
150400.5.18.1
fixed
ovmf-tools-202208
suse enterprise sap 15 SP5
150500.6.9.1
fixed
suse enterprise server 15 SP5
150500.6.9.1
fixed
ovmf-tools-202308
suse enterprise sap 15 SP6
150600.5.14.1
fixed
suse enterprise server 15 SP6
150600.5.14.1
fixed
ovmf-tools-202408
suse enterprise sap 15 SP7
150700.1.3
fixed
suse enterprise server 15 SP7
150700.1.3
fixed
qemu-ovmf-x86_64-202202
suse enterprise sap 15 SP4
150400.5.18.1
fixed
suse enterprise server 15 SP4
150400.5.18.1
fixed
qemu-ovmf-x86_64-202208
suse enterprise sap 15 SP5
150500.6.9.1
fixed
suse enterprise server 15 SP5
150500.6.9.1
fixed
qemu-ovmf-x86_64-202308
suse enterprise sap 15 SP6
150600.5.14.1
fixed
suse enterprise server 15 SP6
150600.5.14.1
fixed
qemu-ovmf-x86_64-202408
suse enterprise sap 15 SP7
150700.1.3
fixed
suse enterprise server 15 SP7
150700.1.3
fixed
qemu-uefi-aarch64-202202
suse enterprise sap 15 SP4
150400.5.18.1
fixed
suse enterprise server 15 SP4
150400.5.18.1
fixed
qemu-uefi-aarch64-202208
suse enterprise sap 15 SP5
150500.6.9.1
fixed
suse enterprise server 15 SP5
150500.6.9.1
fixed
qemu-uefi-aarch64-202308
suse enterprise sap 15 SP6
150600.5.14.1
fixed
suse enterprise server 15 SP6
150600.5.14.1
fixed
qemu-uefi-aarch64-202408
suse enterprise sap 15 SP7
150700.1.3
fixed
suse enterprise server 15 SP7
150700.1.3
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
edk2-aarch64
RHEL 8
0:20220126gitbb1bba3d77-13.el8_10.2
fixed
RHEL 9
0:20231122-6.el9_4.2
fixed
edk2-ovmf
RHEL 8
0:20220126gitbb1bba3d77-13.el8_10.2
fixed
RHEL 9
0:20231122-6.el9_4.2
fixed
edk2-tools
RHEL 9
0:20231122-6.el9_4.2
fixed
edk2-tools-doc
RHEL 9
0:20231122-6.el9_4.2
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
edk2-aarch64
Amazon Linux 2
0:20240813-296.amzn2
fixed
edk2-debuginfo
Amazon Linux 2
0:20240813-296.amzn2
fixed
edk2-ovmf
Amazon Linux 2
0:20240813-296.amzn2
fixed
edk2-tools
Amazon Linux 2
0:20240813-296.amzn2
fixed
edk2-tools-doc
Amazon Linux 2
0:20240813-296.amzn2
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
edk2
Azure Linux 3.0
0:20240223gitedc6681206c1-1.azl3
fixed
CBL-Mariner 2.0
0:20230301gitf80f052277c8-40.cm2
fixed
hvloader
CBL-Mariner 2.0
0:1.0.1-3.cm2
fixed
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2024/01/16/2
https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
https://security.netapp.com/advisory/ntap-20240307-0011/
http://www.openwall.com/lists/oss-security/2024/01/16/2
https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
https://security.netapp.com/advisory/ntap-20240307-0011/
https://www.kb.cert.org/vuls/id/132380