CriticalCVE
Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
The Hacker News·Source published ·1 min read
What happened?
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs first when a computer is switched on, before the operating system.
Key details
- A 16-year-old buffer overflow in EDK II PXE network-boot code allows code execution before Secure Boot loads.
- The bug stems from incorrect size checks when copying ICMP error and status messages into a fixed 504-byte memory area.
- An attacker can trigger the flaw by sending one crafted error message to the machine's address during network boot, without any password or prior access.
- Successful exploitation can allow an attacker to run code within firmware before Secure Boot and other boot-time defenses initialize.
- Operators unable to update firmware can disable PXE network boot to reduce exposure until a BIOS/UEFI update is available.
Affected
- EDK II stable202608 and earlier; UEFI firmware from AMI, Insyde, Phoenix, and Microsoft Project Mu.
- Red Hat Enterprise Linux 8, 9, 10 and SUSE packages containing the affected EDK II code.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.