So you need to send an ICMP packet to a server while it's booting? That seems like an extremely small attack surface. I dont know when the last time our enterprise servers actually booted up, they just stay on forever
show comments
FrasiertheLion
We recently wrote about moving away from OVMF (~1M lines of C) to very minimal and hyperspecific firmware (300 lines of assembly)[1] for our specific confidential VM machine targets, and the idea that "popular" does not automatically mean "secure". You can point an LLM at any large codebase and it will find vulnerabilities, so "patch the planet" isn't very scalable. You can instead just write hyperspecific, small codebases and throw all the security practices at it - like LLMs (economical if it's small), fuzzing, formal methods etc.
I've always been downright suspicious of the creation of UEFI. It executes code before the operating system but doesn't really provide a hardware abstraction layer like BIOS does. Most operating system don't use BIOS or any other software layer and configure the hardware themselves. Why is it there then?
And unlike BIOS which is relatively small UEFI is "full-fat" almost the size of an operating system itself. It can even run its own applications.
The 1 million lines of C code comprising UEFI are riddled with bugs and this is just one of them. No doubt LLMs will be able to uncover a lot more of them.
show comments
DamnInteresting
> There are important caveats and limitations to exploiting this latest vulnerability. As noted, some level of control over a local network is a prerequisite. That likely limits exploitation to insiders or attackers, such as nation-states or ransomware operators, who manage to gain low-level access inside a network and are looking for a way to elevate system rights.
show comments
AppAttestationz
On planet earth? Thank god the ai servers in space are safe!!
verandaguy
The astronauts on the ISS must be breathing a sigh of relief, I imagine.
show comments
mischanix
How is this a 9.5 if php2shell was a 9.2?
show comments
Frieren
And this is the reason why we need datacenters in space.
show comments
dustfinger
Fools! That is why I don't keep my servers on the planet Earth. Mua ha ha ha ha....
saidnooneever
so how many firmwares actually compile in this ICMP stuff? because edk2 builds in a way that it will only package the stuff actually used. u include protocola and handles etc.
personally never found a reason why to include icmp in there for what i was building using edk2.
as others noted pxe is also already very fragile and enough network access to perform the icmp attack is likely enough access to mitm the entire pxe run and slap in your own boot image or modules etc.
i dont think most servers boot using PXE so that is grossly overstated? or would it include the attacker going into the boot menu and selecting to pxe boot... because why use an exploit then if you can just point it to your own server and again pull the image like that.
all u need is a konboot or similar tool inserted to then subsequently load the original image -_-
show comments
croes
Aah, that‘s why Musk wants space datacenters
userbinator
Another breathless fearmongering. "threatens"? No, I don't think network booting is even all that common outside of extremely niche scenarios.
Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources.
Who is PXE-booting over the open Internet!?
show comments
Pavilion2095
Not only this is clickbait, they want me to solve a captcha in order to open it. What a trash website.
So you need to send an ICMP packet to a server while it's booting? That seems like an extremely small attack surface. I dont know when the last time our enterprise servers actually booted up, they just stay on forever
We recently wrote about moving away from OVMF (~1M lines of C) to very minimal and hyperspecific firmware (300 lines of assembly)[1] for our specific confidential VM machine targets, and the idea that "popular" does not automatically mean "secure". You can point an LLM at any large codebase and it will find vulnerabilities, so "patch the planet" isn't very scalable. You can instead just write hyperspecific, small codebases and throw all the security practices at it - like LLMs (economical if it's small), fuzzing, formal methods etc.
[1] https://tinfoil.sh/blog/2026-10-25-less-is-more
I've always been downright suspicious of the creation of UEFI. It executes code before the operating system but doesn't really provide a hardware abstraction layer like BIOS does. Most operating system don't use BIOS or any other software layer and configure the hardware themselves. Why is it there then?
And unlike BIOS which is relatively small UEFI is "full-fat" almost the size of an operating system itself. It can even run its own applications.
The 1 million lines of C code comprising UEFI are riddled with bugs and this is just one of them. No doubt LLMs will be able to uncover a lot more of them.
> There are important caveats and limitations to exploiting this latest vulnerability. As noted, some level of control over a local network is a prerequisite. That likely limits exploitation to insiders or attackers, such as nation-states or ransomware operators, who manage to gain low-level access inside a network and are looking for a way to elevate system rights.
On planet earth? Thank god the ai servers in space are safe!!
The astronauts on the ISS must be breathing a sigh of relief, I imagine.
How is this a 9.5 if php2shell was a 9.2?
And this is the reason why we need datacenters in space.
Fools! That is why I don't keep my servers on the planet Earth. Mua ha ha ha ha....
so how many firmwares actually compile in this ICMP stuff? because edk2 builds in a way that it will only package the stuff actually used. u include protocola and handles etc.
personally never found a reason why to include icmp in there for what i was building using edk2.
as others noted pxe is also already very fragile and enough network access to perform the icmp attack is likely enough access to mitm the entire pxe run and slap in your own boot image or modules etc.
i dont think most servers boot using PXE so that is grossly overstated? or would it include the attacker going into the boot menu and selecting to pxe boot... because why use an exploit then if you can just point it to your own server and again pull the image like that.
all u need is a konboot or similar tool inserted to then subsequently load the original image -_-
Aah, that‘s why Musk wants space datacenters
Another breathless fearmongering. "threatens"? No, I don't think network booting is even all that common outside of extremely niche scenarios.
Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources.
Who is PXE-booting over the open Internet!?
Not only this is clickbait, they want me to solve a captcha in order to open it. What a trash website.