A critical vulnerability found in UEFI allows unauthenticated network access to servers before the operating system loads and security measures are in place.
The related GitHub advisory summarizes the vulnerability — which carries a severity of 9.5 — as follows: “While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error messages to it can corrupt DXE-phase memory and execute arbitrary code before the operating system loads, before Secure Boot or measured boot has verified or measured any OS component.”
The flaw, per reporting from Ars Technica, “resides in the TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence.”
Attackers only need to “deliver a unicast ICMP error message addressed to the client's IP, from any network distance,” the advisory states, and machines remain exposed for the duration of the PXE boot.
Refer to the GitHub advisory and the detailed report from Ars Technica for more information.
