I don't know where Ars Technica got that from, though. The initial advisory [1] says:

> The attacker needs only to deliver a unicast ICMP error message addressed to the client's IP, from any network distance.

[1] https://github.com/tianocore/edk2/security/advisories/GHSA-9...