EDK II NetworkPkg (DHCPv6 Advertise, IA_NA/IA_TA option parsing): An integer underflow when parsing

Impact

An integer underflow when parsing the identity-association options in a DHCPv6 Advertise causes the firmware to read outside its buffer. On its own this leaks firmware memory contents or crashes the boot; chained with the overflow bugs in the same advertisement path it is the information-leak half of a reliable pre-OS exploit (defeating whatever address-layout guesswork the attacker would otherwise need).

Who can reach it

Anyone able to send DHCPv6 Advertise messages on the segment the node PXE-boots from. Unauthenticated, pre-OS.

What to do

Firmware flash via the server OEM's BIOS package - the fix is in upstream edk2 but only reaches you after the IBV rebase and the OEM's own validation cycle. Reboot per node. Config-only stopgap: disable IPv6 network boot, or PXE entirely, and treat the provisioning VLAN as a trust boundary that tenant workloads must never reach.

References