Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
The GET_OPTION_BUFFER_LEN macro is defined as (Pkt)->Length - sizeof(EFI_DHCP4_HEADER) - 4, where sizeof(EFI_DHCP4_HEADER) is 236 bytes and the additional 4 bytes account for the DHCP magic cookie (total 240).
The GET_OPTION_BUFFER_LEN macro in HttpBootDhcp4.h:166 is identical to the PXE variant: (Pkt)->Length - sizeof(EFI_DHCP4_HEADER) - 4.
The local stack array Blank[PXEBC_DISPLAY_MAX_LINE] (70 bytes, line 279) is indexed at line 349 (Blank[MenuArray[Select]->DescLen] = 0;) and line 426 (Blank[MenuArray[LastSelect]->DescLen] = 0;) using the raw DescLen field sourced from the DHCP4 vendor option BOOT_MENU sub-option (option 43, tag 9).
IScsiBuildKeyValueList receives an attacker-controlled iSCSI Login Response data segment (Data/Len) and, after locating the '=' delimiter for each key, calls AsciiStrLen(KeyValuePair->Value) at line 1925 to measure the value string length with no upper bound derived from the remaining Len.
Dhcp6ParseAddrOption iterates over IA_ADDR sub-options within an IA option's inner data using a loop guarded only by Cursor < IaInnerOpt + IaInnerLen (line 1283).
PxeBcParseDhcp6Options iterates over DHCP6 options using a loop guarded only by Offset < Length (line 50).
HttpBootParseDhcp6Options iterates over DHCP6 options using a loop guarded only by Offset < Length (line 149).
Ip6IsOptionValid iterates over TLV-encoded options in IPv6 Hop-by-Hop and Destination Options extension headers using a loop guarded only by while (Offset < OptionLen).
The bounds check at line 425 compares Dst->Size (total buffer allocation = 1480 bytes) against Src->Length (network-controlled, data-only length).
Identical pattern to the DHCP4 variant.
ParseDnsResponse dispatches on the attacker-controlled DNS answer section Type field (AnswerSection->Type, byte-swapped from raw wire bytes at line 1416) via a switch statement at line 1496, selecting between incompatible DNS4_TOKEN_ENTRY (for DNS_TYPE_A) and DNS6_TOKEN_ENTRY (for DNS_TYPE_AAAA) struct interpretations.
Identical bug to Ip4TrimPacket.
Ip6IsExtsValid iterates over the IPv6 extension-header chain using a loop guarded only by while (Offset <= ExtHdrsLen).
PxeBcExtractDiscoverInfo iterates over variable-length PXEBC_BOOT_SVR_ENTRY structures from the DHCP4 vendor option 43 boot-servers sub-option using a loop guarded only by (UINT8)(Entry - VendorOpt->BootSvr) < VendorOpt->BootSvrLen.
PxeBcParseVendorOptions walks the PXE sub-options inside DHCP option 43 using a UINT8 Offset (line 93).
PxeBcParseVendorOptions iterates over PXE sub-options within DHCP option 43 using an outer loop guarded by Offset < VendorOptionLen.
HttpBootParseDhcp6Packet calls AsciiStrLen((CHAR8 *)Options[HTTP_BOOT_DHCP6_IDX_BOOT_FILE_URL]->Data) at line 273 on the raw DHCPv6 OFFER/REPLY boot-file-URL option bytes.
Both Dhcp6SeekOption and Dhcp6SeekIaOption iterate over DHCP6 options using a loop guarded only by Cursor < Buf + SeekLen.
In the HTTP CONNECT (proxy) branch of EfiHttpRequest, EndPointUrlMsg is allocated at line 700 and freed at line 716 without being set to NULL.
ParseDnsResponse processes attacker-controlled DNS answer records in a loop bounded by DnsHeader->AnswersNum from the wire.
When an HTTP server responds with 401 Unauthorized and a WWW-Authenticate header, HttpBootGetBootFile allocates Private->AuthScheme via AllocateZeroPool (line 1486).
TcpQueueData unconditionally calls NET_GET_REF(Nbuf) at line 561, incrementing NET_BUF.RefCnt from 1 to 2.
TcpCloneTcb calls NET_GET_REF(Tcb->IpInfo) at line 551 to increment the reference count of the shared IP_IO_IP_INFO.
In the TAIL branch of Ip4TrimPacket (lines 162–168), the trim length is computed as Len = End - Info->End (INTN).
A remote pre-auth network attacker can send a DHCPv4 reply packet with HwAddrLen > 16 (range 0–255) during PXE/DHCP boot.
// No embargoed advisories.