CVE-2023-45231

A security loophole involving an out-of-bounds read was identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker within the vicinity of the network to transmit a specifically crafted Neighbor Discovery Redirect message. Consequently, this may lead to the unauthorized reading of memory beyond the message boundaries, potentially resulting in the exposure of sensitive information.

The out-of-bounds read vulnerability in EDK2 represents a moderate security concern. This flaw, found in the open-source implementation of the UEFI specification, allows an attacker within the local network to exploit the issue by sending a carefully crafted Neighbor Discovery Redirect message. While requiring proximity for exploitation, the vulnerability could lead to unauthorized memory access and potential leakage of sensitive information.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.