Oracle Linux: CVE-2023-45231: ELSA-2024-12409: edk2 security update (IMPORTANT) (Multiple Advisories)

Description

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing  Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. A security loophole involving an out-of-bounds read was identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker within the vicinity of the network to transmit a specifically crafted Neighbor Discovery Redirect message. Consequently, this may lead to the unauthorized reading of memory beyond the message boundaries, potentially resulting in the exposure of sensitive information.