EDK II NetworkPkg (DHCPv6 DNS Servers option handling): A crafted DNS Servers option inside a DHCPv6 Advertise

Impact

A crafted DNS Servers option inside a DHCPv6 Advertise overflows a firmware buffer, giving memory corruption and a plausible route to pre-boot code execution. Same class of loss as the Server ID overflow: an attacker who lands here is executing inside DXE, above the OS and outside anything the tenant's EDR or attestation agent can see.

Who can reach it

Unauthenticated attacker able to answer DHCPv6 on the provisioning network during the node's PXE boot. No physical access, no host credentials.

What to do

Firmware flash from the server OEM, not from Tianocore - the upstream edk2 patch has to be rebased by your IBV and then re-qualified by the OEM, which historically takes one to two BIOS release cycles. One reboot per node. Immediate config workaround: disable IPv6 in the UEFI network boot stack, or disable network boot on nodes that do not need it, and restrict who can emit DHCPv6/RA on the deployment VLAN.

References