CVE-2023-45230 Overview
CVE-2023-45230 is a buffer overflow vulnerability in the DHCPv6 client of EDK2's Network Package, the open-source reference implementation of the Unified Extensible Firmware Interface (UEFI) maintained by TianoCore. An attacker on an adjacent network can send a crafted DHCPv6 response containing an oversized Server ID option to trigger memory corruption in the network stack used during PXE boot. The flaw is part of the disclosure set known as PixieFail, which targets the UEFI network boot path. Successful exploitation can compromise confidentiality, integrity, and availability of affected firmware. The vulnerability is tracked under [CWE-119] for improper restriction of operations within memory buffer bounds.
Critical Impact
An adjacent-network attacker can corrupt firmware memory during PXE boot by sending a DHCPv6 Advertise message with an overlong Server ID option, leading to potential pre-OS code execution.
Affected Products
- TianoCore EDK2 Network Package (NetworkPkg) — DHCPv6 client module
- Downstream firmware builds incorporating affected EDK2 versions
- Linux distributions packaging vulnerable EDK2 builds, including Fedora and Debian
Discovery Timeline
- 2024-01-16 - CVE-2023-45230 published to NVD as part of the PixieFail disclosure
- 2025-11-04 - Last updated in NVD database
Technical Details for CVE-2023-45230
Vulnerability Analysis
The vulnerability resides in the DHCPv6 client implementation within EDK2's NetworkPkg. The client parses options returned by a DHCPv6 server, including the Server Identifier (DUID) option. The parser copies the option payload into a fixed-size internal buffer without correctly validating that the option length fits within destination buffer bounds. An attacker positioned on the same broadcast domain as a system performing IPv6 PXE boot can answer the client's DHCPv6 solicitation with a malicious Advertise or Reply message carrying an oversized Server ID. The resulting out-of-bounds write occurs in the UEFI pre-boot environment, where standard operating system mitigations such as ASLR and DEP are absent or limited.
Root Cause
The root cause is missing length validation on the Server ID option before the DHCPv6 client copies attacker-controlled data into a stack or heap buffer in the network driver. Because parsing happens in firmware before any operating system is loaded, the corrupted memory belongs to the UEFI runtime, giving an attacker a foothold prior to OS-level defenses.
Attack Vector
Exploitation requires network adjacency (CVSS AV:A) to the target during a PXE/HTTP boot or any boot path that triggers the IPv6 DHCP client. No authentication or user interaction is required. An attacker running a rogue DHCPv6 responder on a LAN can race or replace the legitimate server response. Proof-of-concept material has been published under the PixieFail research disclosure.
No verified exploitation code is included here. Refer to the Packet Storm PixieFail PoC and the GitHub Security Advisory GHSA-hc6x-cw6p-gj7h for technical details.
Detection Methods for CVE-2023-45230
Indicators of Compromise
- DHCPv6 Advertise or Reply messages containing a Server Identifier (option code 2) with an abnormally large length field
- Unexpected DHCPv6 traffic from non-authorized servers on networks that host PXE-bootable systems
- UEFI boot failures, hangs, or unexplained reboots during network boot attempts
Detection Strategies
- Inspect DHCPv6 packet captures for option 2 (Server ID) lengths exceeding typical DUID sizes (RFC 8415 DUIDs are generally under 130 bytes)
- Alert on multiple DHCPv6 servers responding on a single VLAN where only one authorized server is expected
- Correlate firmware version inventory against the fixed EDK2 commits to identify unpatched endpoints
Monitoring Recommendations
- Enable DHCPv6 snooping or guard features on managed switches to block rogue server responses
- Forward switch and IDS logs covering provisioning VLANs to a centralized SIEM for retention and analytics
- Monitor IPv6 router advertisements and DHCPv6 traffic patterns on networks used for bare-metal provisioning
How to Mitigate CVE-2023-45230
Immediate Actions Required
- Update EDK2-based firmware to versions that incorporate the fixes referenced in GHSA-hc6x-cw6p-gj7h
- Apply distribution-level packages from the Fedora announcement and Debian LTS announcement
- Coordinate with hardware vendors and review the NetApp advisory NTAP-20240307-0011 and CERT VU#132380 for product-specific guidance
Patch Information
The upstream fix is published in the EDK2 repository under advisory GHSA-hc6x-cw6p-gj7h. The patch adds bounds validation to the DHCPv6 option parser so that oversized Server ID options are rejected rather than copied into fixed-size buffers. Downstream firmware vendors and Linux distributions have issued corresponding updates; rebuild or reflash any image that bundles EDK2's NetworkPkg.
Workarounds
- Disable IPv6 PXE boot in UEFI setup on systems that do not require network provisioning over IPv6
- Restrict PXE/DHCPv6 traffic to dedicated provisioning VLANs and block DHCPv6 on user-access networks
- Require signed boot images and enable Secure Boot to limit post-corruption persistence options
# Example: block DHCPv6 server traffic on an untrusted interface using ip6tables
ip6tables -A INPUT -p udp --sport 547 --dport 546 -i eth0 -j DROP
ip6tables -A FORWARD -p udp --sport 547 --dport 546 -i eth0 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
