A critical UEFI flaw in EDK2 firmware allows attackers to execute code before OS loads, bypassing security measures. The vulnerability has existed for over sixteen years.
UEFI flaw impacts most servers globally
A critical security flaw has been discovered in the UEFI firmware used in most servers worldwide. The vulnerability, found by researchers from Anthropic and Google, allows an attacker on a local network to run code before the operating system starts, bypassing important security features like Secure Boot and TPM protections.Flaw lies in PXE boot process
The vulnerability is located in the PXE boot process, which some servers use to load their operating systems over a network. A driver in the EDK2 firmware handles ICMP error messages during this process, but it doesn't check the size of the messages it receives.Buffer overflow allows code execution
The driver copies each ICMP message into a fixed memory space of 504 bytes. If an ICMP message is larger than this, it can overwrite data stored after the allocated buffer, potentially affecting the IPv4 and IPv6 managers of the PXE driver. This can lead to unauthorized code execution.Vulnerability has existed for over sixteen years
According to the TianoCore security advisory, the flaw has been present in the firmware for more than sixteen years and was not detected during automated tests following the PixieFail incident. An attacker with access to the system can exploit it by sending a fake ICMP message during the boot sequence, allowing malicious code to run at the highest privilege level of the processor.
