CVE-2023-45235 Overview
CVE-2023-45235 is a buffer overflow vulnerability in the Network Package of TianoCore EDK2, the reference implementation of the Unified Extensible Firmware Interface (UEFI) specification. The flaw resides in the code that processes the Server ID option within a DHCPv6 proxy Advertise message. An attacker on an adjacent network can craft a malicious DHCPv6 Advertise response to overflow a buffer in the network boot stack during the Preboot eXecution Environment (PXE) boot process. Successful exploitation can compromise confidentiality, integrity, and availability of affected firmware. This vulnerability is one of the issues disclosed as part of the PixieFail set of UEFI network stack flaws.
Critical Impact
Adjacent-network attackers can trigger arbitrary code execution at the firmware level during PXE boot, undermining the platform's root of trust before the operating system loads.
Affected Products
- TianoCore EDK2 Network Package (NetworkPkg) DHCPv6 client implementation
- Downstream firmware builds based on EDK2 (server, workstation, and embedded platforms)
- Linux distributions packaging EDK2 / edk2 (Fedora, Debian) and storage vendors shipping EDK2-based firmware (NetApp)
Discovery Timeline
- 2024-01-16 - CVE-2023-45235 published to the National Vulnerability Database
- 2024-01-16 - Public disclosure via OpenWall OSS-Security and Packet Storm proof-of-concept release as part of PixieFail
- 2024-03-07 - NetApp publishes downstream security advisory
- 2025-06 - Debian LTS publishes advisory for the edk2 package
- 2025-11-04 - Last updated in NVD database
Technical Details for CVE-2023-45235
Vulnerability Analysis
The vulnerability is classified as a buffer overflow [CWE-119] in the EDK2 NetworkPkg DHCPv6 client. During PXE boot over IPv6, the firmware sends a DHCPv6 Solicit message and processes incoming Advertise messages from servers. Each Advertise message contains a Server Identifier (Server ID, DUID) option whose length is supplied by the responder. The EDK2 client copies the option payload into a fixed-size buffer without validating that the attacker-controlled length fits the destination. A malicious DHCPv6 responder on the same link can return an oversized Server ID DUID and overwrite adjacent memory in firmware context.
Because the overflow occurs in pre-boot firmware code, exploitation runs with the highest platform privileges, before any operating system, kernel mitigations, or endpoint agents are active. An attacker who controls memory at this layer can install bootkits, disable secure boot enforcement, or persist beneath the OS.
Root Cause
The root cause is missing length validation on the Server ID option parsed from a DHCPv6 proxy Advertise message inside NetworkPkg. The parser trusts the option length field supplied by the network peer and writes its contents into a smaller statically sized buffer, violating the destination object's bounds.
Attack Vector
The attack vector is adjacent network (AV:A). The attacker must be on the same Layer-2 broadcast domain as the victim during PXE boot and must respond to DHCPv6 Solicits faster than, or instead of, the legitimate DHCPv6 server. No authentication or user interaction is required. A rogue DHCPv6 responder, a compromised switch port, or a Wi-Fi-connected adversary in an enterprise provisioning network can deliver the malicious Advertise message.
No verified public exploit code is referenced in the enriched data beyond the PixieFail proof-of-concept archive published on Packet Storm. See the GitHub Security Advisory GHSA-hc6x-cw6p-gj7h and the CERT Vulnerability Note VU#132380 for technical details.
Detection Methods for CVE-2023-45235
Indicators of Compromise
- Unexpected DHCPv6 Advertise messages on provisioning VLANs containing oversized Server Identifier (Option 2) DUIDs.
- Multiple DHCPv6 servers responding on a network segment that should have exactly one authorized responder.
- PXE boot failures, firmware hangs, or unexpected reboots on endpoints that attempt IPv6 network boot.
Detection Strategies
- Capture and inspect DHCPv6 traffic during PXE boot windows and alert on Server ID options exceeding expected DUID lengths (typically under 130 bytes).
- Inventory firmware versions across servers, workstations, and appliances and flag systems running EDK2 builds released before the PixieFail fixes.
- Correlate switch port MAC address changes and unauthorized DHCPv6 server activity through SIEM telemetry.
Monitoring Recommendations
- Enable DHCPv6 guard or RA guard on access switches and log policy violations centrally.
- Forward firmware and platform integrity events (TPM event log, Secure Boot status) to a central data lake for anomaly review.
- Monitor vendor advisories from NetApp, Fedora, and Debian LTS for downstream edk2 package updates.
How to Mitigate CVE-2023-45235
Immediate Actions Required
- Apply the EDK2 patches referenced in GHSA-hc6x-cw6p-gj7h and pull updated firmware from each hardware vendor that ships EDK2-based UEFI.
- Update distribution packages of edk2 and ovmf on virtualization hosts using vendor advisories from Fedora and Debian.
- Disable IPv6 PXE boot in UEFI setup on systems that do not require it until firmware updates are deployed.
Patch Information
The TianoCore project published fixes in NetworkPkg as part of the coordinated PixieFail disclosure. Patched commits are listed in the GitHub Security Advisory GHSA-hc6x-cw6p-gj7h. Downstream patched packages are available from NetApp, Fedora, and Debian LTS. Rebuild and reflash UEFI images using patched EDK2 sources where direct vendor firmware is not yet available.
Workarounds
- Restrict PXE/DHCPv6 boot to isolated, authenticated provisioning VLANs that cannot be reached by untrusted hosts.
- Enable DHCPv6 guard on switch ports facing client devices to drop rogue Advertise messages.
- Prefer IPv4 PXE or HTTPS boot, or disable network boot entirely in firmware setup for systems that do not require remote provisioning.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
