Code-execution flaw in UEFI firmware threatens most servers on planet Earth(arstechnica.com)
38 pointsby DamnInteresting7 hours ago3 comments
  • an hour ago
    undefined
  • saidnooneever5 hours ago
    so how many firmwares actually compile in this ICMP stuff? because edk2 builds in a way that it will only package the stuff actually used. u include protocola and handles etc.

    personally never found a reason why to include icmp in there for what i was building using edk2.

    as others noted pxe is also already very fragile and enough network access to perform the icmp attack is likely enough access to mitm the entire pxe run and slap in your own boot image or modules etc.

    i dont think most servers boot using PXE so that is grossly overstated? or would it include the attacker going into the boot menu and selecting to pxe boot... because why use an exploit then if you can just point it to your own server and again pull the image like that.

    all u need is a konboot or similar tool inserted to then subsequently load the original image -_-

  • DamnInteresting7 hours ago
    > There are important caveats and limitations to exploiting this latest vulnerability. As noted, some level of control over a local network is a prerequisite. That likely limits exploitation to insiders or attackers, such as nation-states or ransomware operators, who manage to gain low-level access inside a network and are looking for a way to elevate system rights.
    • bediger40006 hours ago
      This one seems weird. PXE-boot is such a fragile process in and off itself this doesn't strike me as end-of-the-world. If an attacker has enough presence on your network to send a targeted ICMP packet, they almost certainly could also fool around with your PXE-booting servers some other way.
      • amlutoan hour ago
        Except that a sensible deployment of PXE boot would also have the servers attest to their state prior to giving them any secrets. This vulnerability breaks this workflow.
      • octoberfranklinan hour ago
        Yeah but that just lets them replace the OS that gets booted.

        This gives the attacker access at the UEFI level and above -- they can use it to produce false attestations.