EDK2 Integer Overflow Vulnerability in iSCSI DXE Component Leading to Denial-of-Service

A vulnerability exists in the EDK2 iSCSI DXE component, specifically in versions through 202502, where a user can cause an integer overflow or wraparound via network means. This vulnerability arises when the iSCSI 'Ready To Transfer' (R2T) Protocol Data Units (PDUs) are processed. The exploitation of this vulnerability can lead to a denial-of-service condition by causing the BIOS to reveal memory contents from the iSCSI target, creating a remote memory exposure issue.

Impact

Exploitation of this vulnerability causes a denial-of-service condition and allows for remote memory exposure, where memory contents are leaked from the BIOS to an iSCSI target.