EDK II NetworkPkg (TCP initial sequence number generation): The firmware's TCP initial sequence numbers

Impact

The firmware's TCP initial sequence numbers are predictable, so an off-path attacker can inject into or hijack the boot-time TCP session. In practice that means substituting the payload the node is downloading - the HTTP-boot image, the kernel, the initrd - without ever being on the wire. For a bare-metal GPU cloud that HTTP-boots tenant images, this is a supply-chain swap at provisioning time that no post-boot integrity check will notice if the swapped image is what gets measured.

Who can reach it

Off-path attacker who can guess the ISN - no need to sit on the provisioning segment at all, which makes this materially worse than the on-link PixieFail bugs. Unauthenticated, pre-OS.

What to do

OEM BIOS update; the fix replaces the ISN generator, so there is no configuration toggle that helps. Flash + reboot per node. Compensating control while you wait: use HTTPS boot with proper certificate validation rather than plain HTTP/TFTP, and verify signatures on the downloaded image inside the boot flow rather than relying on transport integrity.

References