EDK II NetworkPkg (IPv6 Neighbor Discovery Redirect handling): A truncated ND Redirect message drives an out-of-bounds

Impact

A truncated ND Redirect message drives an out-of-bounds read in the firmware IPv6 stack. Practical outcome is firmware memory disclosure or a wedged boot; the more interesting operational consequence is that the Redirect path itself lets an on-link attacker steer where the booting node sends its traffic, so this is both a leak and a foothold for redirecting the netboot fetch.

Who can reach it

On-link IPv6 attacker on the provisioning segment - any host that can emit ICMPv6 Neighbor Discovery to the booting node. Unauthenticated, pre-OS.

What to do

OEM BIOS update, flash + reboot per node; the IBV-to-OEM rebase lag applies. Interim: enable IPv6 RA Guard / ND inspection on the provisioning switches, and disable the UEFI IPv6 network stack on nodes that boot locally. No OS-level or config-in-firmware toggle short of turning network boot off.

References