EDK II NetworkPkg (IScsiDxe, Ready-To-Transfer PDU handling): A malicious iSCSI target sends a crafted R2T PDU

Impact

A malicious iSCSI target sends a crafted R2T PDU with a bogus offset and length, and the booting firmware obligingly transmits chunks of its own memory back to the target. Low severity on paper, and it is a read-only leak, but what leaks is DXE-phase memory - boot secrets, variable contents, buffer addresses - which is exactly the reconnaissance an attacker needs before firing one of the higher-severity overflow bugs in the same stack.

Who can reach it

An attacker controlling or impersonating the iSCSI target a node boots from. Unauthenticated, pre-OS, from the storage network.

What to do

OEM BIOS update, flash + reboot per node - but given the low score, do not expect OEMs to ship it urgently or to call it out prominently in release notes. The config workaround is the better first move: turn off the UEFI iSCSI initiator on nodes that boot locally, require mutual CHAP where you do boot from SAN, and segment the storage fabric.

References