EDK2s Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
Weakness
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG’s algorithm is not cryptographically strong.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Edk2 | Tianocore | * | 202311 (including) |
| Red Hat Enterprise Linux 8 | RedHat | edk2-0:20220126gitbb1bba3d77-13.el8_10.2 | * |
| Red Hat Enterprise Linux 9 | RedHat | edk2-0:20231122-6.el9_4.2 | * |
| Red Hat Enterprise Linux 9.2 Extended Update Support | RedHat | edk2-0:20221207gitfff6d81270b5-9.el9_2.3 | * |
| Edk2 | Ubuntu | bionic | * |
| Edk2 | Ubuntu | esm-apps/bionic | * |
| Edk2 | Ubuntu | esm-apps/xenial | * |
| Edk2 | Ubuntu | esm-infra/focal | * |
| Edk2 | Ubuntu | focal | * |
| Edk2 | Ubuntu | jammy | * |
| Edk2 | Ubuntu | lunar | * |
| Edk2 | Ubuntu | mantic | * |
| Edk2 | Ubuntu | noble | * |
| Edk2 | Ubuntu | oracular | * |
| Edk2 | Ubuntu | trusty | * |
| Edk2 | Ubuntu | upstream | * |
| Edk2 | Ubuntu | xenial | * |
Extended Description
When a non-cryptographic PRNG is used in a cryptographic context, it can expose the cryptography to certain types of attacks. Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a mediocre source of randomness is sufficient or preferable for algorithms that use random numbers. Weak generators generally take less processing power and/or do not use the precious, finite, entropy sources on a system. While such PRNGs might have very useful features, these same features could be used to break the cryptography.
Potential Mitigations
References
- http://www.openwall.com/lists/oss-security/2024/01/16/2
- https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
- https://security.netapp.com/advisory/ntap-20240307-0011/
- http://www.openwall.com/lists/oss-security/2024/01/16/2
- https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
- https://security.netapp.com/advisory/ntap-20240307-0011/
- https://www.kb.cert.org/vuls/id/132380