EDK II NetworkPkg (DHCPv6 proxy Advertise, Server ID option): Buffer overflow in the proxy-DHCPv6 path

CVSS 8.8CVE-2023-45235Firmware, BMC & network fabricPixieFailVU#132380curated

Impact

Buffer overflow in the proxy-DHCPv6 path - the exact path a PXE/HTTP-boot provisioning flow uses when the boot server and the address server are different boxes. Memory corruption in DXE means the attacker can potentially take the node before it has an OS, which for a multi-tenant bare-metal GPU fleet means a persistent foothold that outlives the tenant lease and the reimage.

Who can reach it

Unauthenticated, on-link attacker impersonating or racing the proxy DHCPv6 server on the provisioning segment. Pre-OS.

What to do

OEM BIOS update, flash and reboot each node. There is no OS-level patch and no runtime mitigation - the vulnerable code runs before the OS. Until the OEM ships, the practical controls are network-side: segment the provisioning VLAN away from tenant traffic, enforce DHCPv6 guard on access ports, and disable UEFI network boot on any node whose boot source is local NVMe.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-45235 https://kb.cert.org/vuls/id/132380 https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.