{"id":112965,"date":"2024-01-17T23:28:01","date_gmt":"2024-01-17T21:28:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pixiefail-uyazvimosti-v-setevom-steke-proshivok-uefi-primenyaemom-dlya-pxe-zagruzki"},"modified":"2024-01-17T23:28:01","modified_gmt":"2024-01-17T21:28:01","slug":"pixiefail-uyazvimosti-v-setevom-steke-proshivok-uefi-primenyaemom-dlya-pxe-zagruzki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/pixiefail-uyazvimosti-v-setevom-steke-proshivok-uefi-primenyaemom-dlya-pxe-zagruzki","title":{"rendered":"PixieFAIL \u2014 vulnerabilities in the UEFI firmware network stack used for PXE booting","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nine vulnerabilities, collectively codenamed PixieFAIL, have been identified in UEFI firmware based on the open source platform TianoCore EDK2, commonly used in server systems. These vulnerabilities exist in the firmware's network stack, which is used for network booting (PXE). The most critical vulnerabilities allow an unauthenticated attacker to execute their code remotely at the firmware level on systems that permit PXE booting using IPv6. <\/p>\n

Less severe issues lead to denial of service (boot blocking), information leakage, DNS cache poisoning, and interception of TCP sessions. Most vulnerabilities can be exploited from the local network, but some allow attacks from the external network as well. A typical attack scenario involves monitoring traffic on the local network and sending specially crafted packets upon detecting activity related to PXE system boot. Access to server<\/a> the boot process or DHCP server is not required. Prototypes of exploits have been published to demonstrate the attack technique. <\/p>\n

UEFI firmware based on the TianoCore EDK2 platform is used by many large companies, cloud providers, data centers, and computing clusters. In particular, the vulnerable NetworkPkg module implementing PXE booting is used in firmware developed by companies such as ARM, Insyde Software (Insyde H20 UEFI BIOS), American Megatrends (AMI Aptio OpenEdition), Phoenix Technologies (SecureCore), Intel, Dell, and Microsoft (Project Mu). It was thought that the vulnerabilities also affect the ChromeOS platform, which has a package of EDK2 in its repository, but Google stated that this package is not used in the firmware for Chromebook devices and that the ChromeOS platform is not susceptible to the issue. <\/p>\n

Identified vulnerabilities: <\/p>\n