Description
EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
References (7)
Core 7
Core References
Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/132380
Vendor Advisory
https://security.netapp.com/advisory/ntap-20240307-0011/
Vendor Advisory vendor-advisory
https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
Scores
CVSS v3
6.5
EPSS
0.0013
EPSS Percentile
32.4%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-125
Status
published
Products (1)
tianocore/edk2
< 202311
Published
Jan 16, 2024
Tracked Since
Feb 18, 2026