CVE-2023-45235: Tianocore EDK2 Buffer Overflow Vulnerability

CVE-2023-45235 Overview

CVE-2023-45235 is a buffer overflow vulnerability in EDK2's Network Package that occurs when handling the Server ID option from a DHCPv6 proxy Advertise message. This vulnerability is part of the "PixieFail" collection of vulnerabilities affecting UEFI firmware's network stack implementation. An attacker on an adjacent network can exploit this flaw to gain unauthorized access to affected systems, potentially leading to a complete compromise of confidentiality, integrity, and availability.

Critical Impact

This buffer overflow vulnerability in UEFI firmware allows adjacent network attackers to achieve code execution during the PXE boot process, potentially compromising systems before the operating system loads.

Affected Products

• Tianocore EDK2 (all versions prior to patch)
• Systems using EDK2-based UEFI firmware with network boot capabilities
• Enterprise servers and workstations utilizing PXE boot functionality

Discovery Timeline

• 2024-01-16 - CVE-2023-45235 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2023-45235

Vulnerability Analysis

The vulnerability resides in EDK2's Network Package, specifically in the handling of DHCPv6 protocol messages during PXE (Preboot Execution Environment) network boot operations. When processing a DHCPv6 proxy Advertise message, the firmware fails to properly validate the length of the Server ID option before copying it into a fixed-size buffer. This improper buffer boundary check (CWE-119) allows an attacker to overflow the buffer with malicious data.

The attack occurs at the firmware level during the boot process, before any operating system security controls are active. This makes the vulnerability particularly dangerous as traditional endpoint security solutions are not yet loaded when the exploit executes. The adjacent network attack vector requires the attacker to be on the same network segment as the target system, typically achieved through compromising network infrastructure or physical access to the local network.

Root Cause

The root cause of CVE-2023-45235 is improper restriction of operations within the bounds of a memory buffer (CWE-119). The DHCPv6 client implementation in EDK2's Network Package does not adequately validate the size of the Server ID option field before copying its contents. When a maliciously crafted DHCPv6 Advertise message contains an oversized Server ID option, the firmware copies this data beyond the allocated buffer boundaries, corrupting adjacent memory regions.

Attack Vector

An attacker positioned on an adjacent network can exploit this vulnerability by setting up a rogue DHCPv6 server or performing a man-in-the-middle attack on DHCPv6 traffic. When a target system initiates a PXE boot sequence, the attacker responds with a specially crafted DHCPv6 Advertise message containing a malformed Server ID option. The oversized Server ID triggers the buffer overflow, allowing the attacker to overwrite critical memory structures and potentially achieve arbitrary code execution within the UEFI environment.

The exploitation occurs during the early boot phase, meaning successful attacks can:

• Install persistent firmware-level malware (bootkits)
• Bypass Secure Boot protections
• Compromise the system before any OS-level defenses activate
• Establish persistent access that survives OS reinstallation

Proof-of-concept code for this vulnerability has been published as part of the PixieFail collection. For technical details, refer to the PixieFail PoC Source.

Detection Methods for CVE-2023-45235

Indicators of Compromise

• Unusual DHCPv6 traffic patterns on the network, particularly oversized Advertise messages
• Rogue DHCPv6 servers appearing on network segments with PXE boot-enabled systems
• Systems experiencing boot failures or unexpected behavior during PXE boot sequences
• Network traffic analysis showing anomalous Server ID option lengths in DHCPv6 messages

Detection Strategies

• Deploy network monitoring to detect DHCPv6 traffic anomalies and unauthorized DHCP servers
• Implement DHCP snooping and DHCPv6 guard on network switches to prevent rogue server attacks
• Monitor firmware integrity using hardware-based attestation mechanisms where available
• Conduct regular firmware version audits to identify systems running vulnerable EDK2 versions

Monitoring Recommendations

• Enable DHCPv6 traffic logging on network infrastructure devices
• Configure alerts for new DHCPv6 servers appearing on protected network segments
• Implement network segmentation to isolate PXE boot traffic from general network traffic
• Use SentinelOne's network visibility features to monitor for suspicious boot-time network activity

How to Mitigate CVE-2023-45235

Immediate Actions Required

• Update EDK2-based firmware to the latest patched version from your system vendor
• Disable PXE boot functionality on systems where network boot is not required
• Implement network-level controls to restrict DHCPv6 traffic to authorized servers only
• Isolate systems requiring PXE boot on dedicated, secured network segments

Patch Information

Tianocore has released security patches addressing this vulnerability. System administrators should obtain firmware updates from their respective hardware vendors, as EDK2 is typically distributed as part of vendor-specific UEFI implementations. Consult the GitHub Security Advisory for detailed patch information. Additional vendor-specific advisories are available from NetApp Security Advisory and distribution packages from Fedora Package Announcement.

Workarounds

• Disable IPv6 and DHCPv6 in UEFI/BIOS settings if not required for operations
• Configure systems to use static IP addressing for network boot instead of DHCP
• Implement 802.1X port-based authentication to prevent unauthorized devices from responding to DHCPv6 requests
• Enable Secure Boot with proper key management to limit the impact of potential exploitation

# Example: Disable PXE boot in UEFI settings via Linux efibootmgr
# List current boot options
efibootmgr -v

# Identify and disable network boot entries (example with boot entry 0003)
efibootmgr -b 0003 -A

# Alternatively, configure DHCP snooping on Cisco switches
# configure terminal
# ip dhcp snooping
# ip dhcp snooping vlan 10
# interface GigabitEthernet0/1
# ip dhcp snooping trust