EDK II NetworkPkg (IScsiDxe, Ready-To-Transfer PDU handling): A malicious iSCSI target sends a crafted R2T PDU

CVSS 3.5CVE-2025-2295Firmware, BMC & network fabricGHSA-8522-69fh-w74xcurated

Impact

A malicious iSCSI target sends a crafted R2T PDU with a bogus offset and length, and the booting firmware obligingly transmits chunks of its own memory back to the target. Low severity on paper, and it is a read-only leak, but what leaks is DXE-phase memory - boot secrets, variable contents, buffer addresses - which is exactly the reconnaissance an attacker needs before firing one of the higher-severity overflow bugs in the same stack.

Who can reach it

An attacker controlling or impersonating the iSCSI target a node boots from. Unauthenticated, pre-OS, from the storage network.

What to do

OEM BIOS update, flash + reboot per node - but given the low score, do not expect OEMs to ship it urgently or to call it out prominently in release notes. The config workaround is the better first move: turn off the UEFI iSCSI initiator on nodes that boot locally, require mutual CHAP where you do boot from SAN, and segment the storage fabric.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-2295 https://github.com/tianocore/edk2/security/advisories/GHSA-8522-69fh-w74x

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.