CVE-2023-45230 – EDK2's Network Package has a buffer overflow vu... (How to Fix)

Q: What is the severity of CVE-2023-45230?

CVE-2023-45230 has a CVSS score of 8.3 (HIGH). EDK2's Network Package has a buffer overflow vulnerability in the DHCPv6 client when processing long server ID options. Attackers on the same network can exploit this to execute arbitrary code or cause denial of service. This affects systems using EDK2 firmware with DHCPv6 enabled, including servers, workstations, and embedded devices.

📋 TL;DR

EDK2's Network Package has a buffer overflow vulnerability in the DHCPv6 client when processing long server ID options. Attackers on the same network can exploit this to execute arbitrary code or cause denial of service. This affects systems using EDK2 firmware with DHCPv6 enabled, including servers, workstations, and embedded devices.

💻 Affected Systems

Products:

EDK2 (UEFI Development Kit)
Systems using EDK2-based firmware
Various UEFI implementations

Versions: EDK2 versions prior to commit 0b975d2 (2024-01-16)

Operating Systems: All operating systems running on affected UEFI firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Requires DHCPv6 client functionality to be enabled and used. Many systems enable this by default in UEFI/BIOS settings.

📦 What is this software?

Edk2 by Tianocore

View all CVEs affecting Edk2 →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with firmware-level privileges leading to complete system compromise, persistent malware installation, or bricking of hardware.

🟠

Likely Case

System crash/reboot causing denial of service, or limited code execution within firmware context.

🟢

If Mitigated

Denial of service only if exploit attempts are blocked or contained by network segmentation.

🌐 Internet-Facing: MEDIUM - Requires attacker on same network segment; internet exposure limited to systems with DHCPv6 directly exposed.

🏢 Internal Only: HIGH - Internal attackers or compromised internal systems can exploit this on vulnerable systems within the same network.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Proof-of-concept code is publicly available as part of PixieFail research. Exploitation requires network access to send malicious DHCPv6 packets.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: EDK2 commit 0b975d2 and later

Vendor Advisory: https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h

Restart Required: Yes

Instructions:

1. Update EDK2 firmware to version containing commit 0b975d2 or later. 2. Check with hardware vendor for firmware updates. 3. Apply firmware update following vendor instructions. 4. Reboot system to activate new firmware.

🔧 Temporary Workarounds

Disable DHCPv6 in UEFI/BIOS

all

Disable DHCPv6 client functionality in system firmware settings

Network segmentation and filtering

all

Segment networks and filter DHCPv6 traffic to prevent malicious packets from reaching vulnerable systems

🧯 If You Can't Patch

Segment vulnerable systems on isolated network segments
Implement network monitoring for abnormal DHCPv6 traffic patterns

🔍 How to Verify

Check if Vulnerable:

Check EDK2 version or firmware date; systems with firmware dated before 2024-01-16 are likely vulnerable. Check with 'dmidecode' or firmware settings for version info.

Check Version:

dmidecode -t bios | grep -i version

Verify Fix Applied:

Verify firmware version includes EDK2 commit 0b975d2 or later. Check firmware update logs for successful application.

📡 Detection & Monitoring

Log Indicators:

System crashes or reboots without clear cause
Firmware/UEFI error messages
DHCPv6 server logs showing malformed requests

Network Indicators:

Unusual DHCPv6 traffic with oversized server ID options
DHCPv6 packets from unexpected sources

SIEM Query:

source="dhcpv6" AND (option_length>normal OR packet_size>threshold)

📊 Metadata

CVE ID: CVE-2023-45230

CVSS v3 Score: 8.3 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

CWE: CWE-119

Published: January 16, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-45230, you might also want to check these: