{"id":112965,"date":"2024-01-17T23:28:01","date_gmt":"2024-01-17T21:28:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pixiefail-uyazvimosti-v-setevom-steke-proshivok-uefi-primenyaemom-dlya-pxe-zagruzki"},"modified":"2024-01-17T23:28:01","modified_gmt":"2024-01-17T21:28:01","slug":"pixiefail-uyazvimosti-v-setevom-steke-proshivok-uefi-primenyaemom-dlya-pxe-zagruzki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/pixiefail-uyazvimosti-v-setevom-steke-proshivok-uefi-primenyaemom-dlya-pxe-zagruzki","title":{"rendered":"PixieFAIL \u2014 vulnerabilidades en la pila de red de los firmwares UEFI utilizados para el arranque PXE","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Se han identificado 9 vulnerabilidades con el nombre en c\u00f3digo colectivo PixieFAIL en las implementaciones de firmware UEFI basadas en la plataforma abierta TianoCore EDK2, com\u00fanmente utilizadas en sistemas de servidores. Las vulnerabilidades se encuentran en la pila de red del firmware, utilizada para la carga de red (PXE). Las vulnerabilidades m\u00e1s peligrosas permiten que un atacante no autenticado ejecute c\u00f3digo remotamente en el nivel del firmware en sistemas que permiten arranque PXE utilizando la red IPv6.     <\/p>\n<p>Los problemas menos graves conducen a denegaci\u00f3n de servicio (bloqueo del arranque), filtraci\u00f3n de informaci\u00f3n, envenenamiento de cach\u00e9 DNS y secuestro de sesiones TCP. La mayor\u00eda de las vulnerabilidades pueden ser explotadas desde la red local, pero algunas permiten ataques desde una red externa. Un escenario de ataque t\u00edpico implica la monitorizaci\u00f3n del tr\u00e1fico en la red local y el env\u00edo de paquetes especialmente dise\u00f1ados al detectar actividad relacionada con la carga del sistema a trav\u00e9s de PXE. No se requiere acceso a <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/es\/server\/dts-shicago\/\"   title=\"servidor\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2874\">servidor<\/a> la carga o al servidor DHCP. Se han publicado prototipos de exploits para demostrar la t\u00e9cnica del ataque.       <\/p>\n<p>Los firmwares UEFI basados en la plataforma TianoCore EDK2 se utilizan en muchas grandes empresas, proveedores de nube, centros de datos y cl\u00fasteres de computaci\u00f3n. En particular, el m\u00f3dulo vulnerable NetworkPkg, que implementa la carga PXE, es utilizado en los firmwares desarrollados por empresas como ARM, Insyde Software (Insyde H20 UEFI BIOS), American Megatrends (AMI Aptio OpenEdition), Phoenix Technologies (SecureCore), Intel, Dell y Microsoft (Project Mu). Se supon\u00eda que las vulnerabilidades tambi\u00e9n afectaban a la plataforma ChromeOS, que tiene un paquete EDK2 en su repositorio, pero Google declar\u00f3 que dicho paquete no se utiliza en los firmwares para dispositivos Chromebook y que la plataforma ChromeOS no est\u00e1 afectada por este problema.        <\/p>\n<p>Vulnerabilidades detectadas:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-45230 \u2014 desbordamiento de b\u00fafer en el c\u00f3digo del cliente DHCPv6, explotado a trav\u00e9s de la transmisi\u00f3n de un identificador demasiado largo. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/es\/server\/dts-los-angeles\/\"   title=\"servidores\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3612\">servidores<\/a> (opci\u00f3n Server ID).\n<li class=\"l\"> CVE-2023-45234 \u2014 desbordamiento de b\u00fafer al procesar la opci\u00f3n con par\u00e1metros del servidor DNS, transmitidos en un mensaje que anuncia la disponibilidad del servidor DHCPv6.\n<li class=\"l\"> CVE-2023-45235 \u2014 desbordamiento de b\u00fafer al procesar la opci\u00f3n con el identificador del servidor (Server ID) en los mensajes que anuncian un servidor proxy para DHCPv6.\n<li class=\"l\"> CVE-2023-45229 \u2014 desbordamiento entero a trav\u00e9s de un l\u00edmite inferior (underflow), que se manifiesta al procesar opciones IA_NA\/IA_TA en mensajes DHCPv6 que anuncian un servidor DHCP.\n<li class=\"l\"> CVE-2023-45231 \u2014 fuga de datos desde fuera del b\u00fafer al procesar mensajes ND Redirect (Descubrimiento de Vecinos) con valores truncados de opciones.\n<li class=\"l\"> CVE-2023-45232 \u2014 bucle infinito al analizar opciones desconocidas en el encabezado con par\u00e1metros de opciones de destino (Destination Options).\n<li class=\"l\"> CVE-2023-45233 \u2014 bucle infinito al analizar la opci\u00f3n PadN en el encabezado del paquete.\n<li class=\"l\"> CVE-2023-45236 \u2014 uso de n\u00fameros de secuencia TCP iniciales predecibles, permitiendo interferir en la conexi\u00f3n TCP.\n<li class=\"l\"> CVE-2023-45237 \u2014 uso de un generador de n\u00fameros pseudoaleatorios poco fiable, que produce valores predecibles.  <\/ul>\n<p>La informaci\u00f3n sobre las vulnerabilidades fue enviada al CERT\/CC el 3 de agosto de 2023, y la fecha de divulgaci\u00f3n estaba programada para el 2 de noviembre. Sin embargo, debido a la necesidad de un lanzamiento coordinado de parches que abarca a varios proveedores, la fecha de publicaci\u00f3n se aplaz\u00f3 inicialmente al 1 de diciembre y luego se traslad\u00f3 al 12 de diciembre y al 19 de diciembre de 2023, pero finalmente se divulg\u00f3 el 16 de enero de 2024. Microsoft solicit\u00f3 retrasar la divulgaci\u00f3n de la informaci\u00f3n hasta mayo.<br \/>\n<br \/>Fuente: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60449\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b TianoCore EDK2, \u043e\u0431\u044b\u0447\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PixieFAIL. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 (PXE). \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0445 PXE-\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u0435\u0442\u0438 IPv6. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112965","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b TianoCore EDK2, \u043e\u0431\u044b\u0447\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PixieFAIL.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/es\/blog\/news\/pixiefail-uyazvimosti-v-setevom-steke-proshivok-uefi-primenyaemom-dlya-pxe-zagruzki\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"es_ES\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47PixieFAIL \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a UEFI, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f PXE-\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b TianoCore EDK2, \u043e\u0431\u044b\u0447\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PixieFAIL.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/es\/blog\/news\/pixiefail-uyazvimosti-v-setevom-steke-proshivok-uefi-primenyaemom-dlya-pxe-zagruzki\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-01-17T21:28:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-01-17T21:28:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47PixieFAIL \u2014 vulnerabilidades en la pila de red de los firmwares UEFI utilizada para el arranque PXE | ProHoster","description":"Se han identificado 9 vulnerabilidades en los firmwares UEFI basados en la plataforma abierta TianoCore EDK2, com\u00fanmente utilizados en sistemas de servidor, que han recibido el nombre en clave colectivo PixieFAIL.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/pixiefail-uyazvimosti-v-setevom-steke-proshivok-uefi-primenyaemom-dlya-pxe-zagruzki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47PixieFAIL \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a UEFI, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f PXE-\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 | ProHoster","og:description":"\u0412 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b TianoCore EDK2, \u043e\u0431\u044b\u0447\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PixieFAIL.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/pixiefail-uyazvimosti-v-setevom-steke-proshivok-uefi-primenyaemom-dlya-pxe-zagruzki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-17T21:28:01+00:00","article:modified_time":"2024-01-17T21:28:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112965","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:41:52","updated":"2026-02-22 15:29:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/112965","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=112965"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/112965\/revisions"}],"predecessor-version":[{"id":162139,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/112965\/revisions\/162139"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=112965"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=112965"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=112965"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}