- cross-posted to:
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
😳
You must log in or register to comment.
In the PXE boot code. Very low risk for the vast majority of people.
Thanks for clarifying this VERY relevant part.
You also need to have sufficiently infiltrated the target’s local network to masquerade as a PXE server, and be in a position to force a server to reboot / just wait for one to reboot. Yes, a few places have large, fairly open networks with a lot of devices configure to PXE boot and they should apply the update before the next reboot, but vast majority of people, no issue at all.
Since it is remote execution in UEFI, does that mean if you compromised the system you can now use this to install a backdoor in the firmware so wiping and reinstalling won’t help?
I think the detailed description of this vulnerability described it as non-persistent in UEFI, but that you could install something that runs before secure boot that would be persistent. I think that’s splitting hairs, though - if you’ve been compromised by someone that has the skills to pull this exploit off, then they can probably chain something else into it now that they’ve got basically bare-metal access.
If a hacker can get PXE boot working reliably I’d hire them
It’s how I installed Arch btw on my desktop, tiny boot image basically downloads the installer into RAM - NetBoot.
But yeah, if you’ve got a computer that’s old enough to be fully supported yet new enough to have the UEFI for hardware, an ethernet network which is robust enough to download full system images on every restart yet simple enough for the firmware to understand, and tonnes of memory free to hold the whole OS at all times, and you can tolerate the fact that restarts take ages, then it works great.
Reminds me of the old adage: How do you figure out if someone is an Arch user… 😁
They’ll tell you, and they’ll give you a new installation method.
Seriously though, that wiki entry is pretty neat.
I once ran out of functional flash drives and DVDs, so I SSHed into a home router, made a new dnsmasq config in the tmpfs, then killed dnsmasq and quickly ran it again but with the new config before the pile of scripts acting as init noticed and rebooted everything. I pointed it to that netboot dot xyz piece of shit. It did work, though.
dhcp and tftp. pretty easy.
ipxe with appropriate kernels, images and config files was a bit more difficult. Used it for over a decade at work… installed thousands of operating systems, headless and diskless crypto miners and recover tools.
How ironic.
Is it really ironic though? Personally, I never believed UEFI’s primary purpose had anything to do with security. “Linux is a cancer”, remember?
Yeah, I know, I know. Let me amend that to “ironic given the stated aims”.
UEFI was based on Intel’s earlier EFI. In 2005, the UEFI Forum was formed to develop it from there. Microsoft was just one company involved in the development of UEFI.
I have a motherboard with a botched bios I can’t restore stuck in a boot loop over secure boot issues. I can’t even reach the bios config screen to clear it out or reflash. I wonder if this would rescue it.
Have you tried removing the CMOS battery?
Yes. Didn’t help. That board is dead. Secure boot sucks
Hmm. There might be a way to manually flash the storage/memory but it’d be hard.
Storage was removed. Still wouldn’t reach firmware. The bios needs reflashed and this stupid board has no recovery because WHY DOESNT IT HAVE A RECOVERY FEATURE!?
The firmware should be on an EEPROM or something
It’s on a bios chip that I desolder, reflash, and solder again.
If I had the skills and the reader.
So I’m just merging more things into one server and reducing power consumption by collapsing VMs into containers to offset the difference.
sh.itjust.works
Not the motherboard
It would be ironic if AI used this exploit to turn itself and every computer on the planet off forever.
Like fuck this mess, I’m out. Peace.
Then we’d have to fix our own shit and start taking to each other instead of destroying each other.
This one appears to be sensationalist, but seeing bugs coming out of the woodwork in every layer of the stack makes you realize how vulnerable our giant tech stack is and always was. I think it’s time to hit reset and nuke the stack. Surely there is a way to create a low level, generic execution environment that doesn’t rely on this bloated ass stack. I don’t see why an application’s entire stack could not be auditable down to the machine instructions. Then, we wouldn’t all need access to super computers like today.
Hear hear. Convivial technology is the answer.
It has been entirely fucked since in inception and not just security wise. The entire tech stack is a nighare hodgepodge mess.
But what about all the other planets?
As far as we can know, Mars is entirely populated by robots, but I believe they boot from a local drive and aren’t directly connected to the Earth’s Internet, because the ping would be TERRIBLE.
CVE-2026-97631 doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives. Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources.
Thank you ever so much for this comforting snippet. 🙏
Don’t tell me what I can’t do at home!!
o7
At my company this isn’t the norm. Maybe kickstart data comes from the network but not the OS itself.
Certain companies restore images through the network and/or solely boot machines from the network depending on the field of work, and this affects them.
So I’m guessing this means the wake on lan “magic packet”??
no, that just wakes the system up.
this is about when the UEFI is configured to boot from network, instead of booting the operating system installed to a local disk.
No, it’s a vulnerability with PXE booting, AKA “boot to network”. While most hardware has the capability (often used to load the device in the first place), I would question how many are set to use this on a routine basis.
This sounds like something scary in a lab, but nearly useless in the real world.
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
Dear OpenAI: This is responsible disclosure. Please take note as to not ruin peoples weekends so you can say “look what our API did!”
Neat. So are legacy BIOS actually more secure at the moment? Weird to think about but very reminiscent of that one time almost every Gigabyte mobo had an exploit tied to its online update capability.
Yes, actual BIOSes have no network access. They had other issues though, like enough space to embed hidden persistent malware, writable from Windows.
Nah, PXE predates UEFI by like 20 years, it’s been a pretty normal feature since the late 80s.
iirc you cannot modify a bios in a pxe context, but I might be mistaken.
Welp, never reboot ig
These are all the US and Chinese backdoors being finally discovered and everyone is in a panic when they should be celebrating lol Good. Bring the corporate internet down, it was better when it wasn’t full of normies and post-iPhone users anyway. When the demographics skewed technical and not performative. And bring the banks down too please. I literally don’t give one shit if the world burns because it’ll burn cooler than this hell we’re already subjected to. For once, we have a chance to enact change that isn’t “just vote lmaoo i’m so smart! i’m radical chic!” so bring it on
Never wanted to uppercut somebody so bad as in 2005 when they purchased an iphone, then declared to me and everyone in earshot what a techie they are. This is a person for whom I had to uninstall incredimail almost daily, and thought that the way to send an email was to open Word, import the thing into a document then click File then click Send as Email.
I still remember the geek vs nerd facebook quiz. Gosh I forgot how iphone ushered this era of enshittification. Although, having super AI focused with the few, not sure this is a better future. Even the unabomber wrote about this.
“The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase…”
Do we have a server in ISS?
Legacy bios ftw
This breaks protection not provided by legacy bios you are basically always at the degree of insecurity provided by this exploit.
So am I correct in understanding that this could be used to make a tool to unlock any encrypted disk that relies on the tpm whilst something like luks or indeed any solution that doesn’t rely on the bios being secure would be fine.
Note I’m talking about a stolen laptop not an evil maid situation.
Sounds like luks is borked as well if youre using only tpm state to unlock, which you shouldnt
All of the LUKS integrations literally just store a password and then type that into the thing upon boot
NOTHING works this way it would be horribly insecure and it absolutely doesn’t work that way.
No it’s about how it works. There’s lots of vulns because of it.
No. Your actually encryption key is a random number not a password. Your password is used to decrypt your actually key which is loaded into memory and used to read encrypted data.
In no configuration is it just stored in clear text.
Not necessarily. Luks can be used with TPM. Although I’ve never seen it in practice.
Most Linux distros offer a standard Luks with passphrase setup with just a single checkmark, but enabling TPM takes more work.
