EDK II NetworkPkg (PseudoRandom number generation used by the network stack): The weak PRNG behind the previous issue

Impact

The weak PRNG behind the previous issue - the firmware's randomness source is not random enough for anything security-relevant it feeds, including sequence numbers and transaction identifiers used during netboot. The operator-visible consequence is that boot-time network exchanges are spoofable by an attacker who does not need to see them.

Who can reach it

Off-path or on-path attacker predicting firmware-generated values during network boot. Unauthenticated, pre-OS.

What to do

Firmware flash via the server OEM. Reboot per node. There is nothing to configure - the entropy source is compiled in. Until patched, assume boot-time network exchanges are forgeable and lean on cryptographic verification of the boot payload (signed images, Secure Boot with your own keys) rather than on network trust.

References