EDK II NetworkPkg (DHCPv6 proxy Advertise, Server ID option): Buffer overflow in the proxy-DHCPv6 path

Impact

Buffer overflow in the proxy-DHCPv6 path - the exact path a PXE/HTTP-boot provisioning flow uses when the boot server and the address server are different boxes. Memory corruption in DXE means the attacker can potentially take the node before it has an OS, which for a multi-tenant bare-metal GPU fleet means a persistent foothold that outlives the tenant lease and the reimage.

Who can reach it

Unauthenticated, on-link attacker impersonating or racing the proxy DHCPv6 server on the provisioning segment. Pre-OS.

What to do

OEM BIOS update, flash and reboot each node. There is no OS-level patch and no runtime mitigation - the vulnerable code runs before the OS. Until the OEM ships, the practical controls are network-side: segment the provisioning VLAN away from tenant traffic, enforce DHCPv6 guard on access ports, and disable UEFI network boot on any node whose boot source is local NVMe.

References