{"id":184024,"date":"2026-10-28T23:40:36","date_gmt":"2026-10-28T21:40:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-uefi-proshivkah-ekspluatiruemaya-cherez-otpravku-icmp-paketa"},"modified":"2026-10-28T23:40:41","modified_gmt":"2026-10-28T21:40:41","slug":"remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","title":{"rendered":"Vulnerabilit\u00e0 remota nei firmware UEFI dei server, sfruttabile tramite l'invio di pacchetti ICMP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In TianoCore EDK II (EFI Development Kit II), the open reference implementation of UEFI used in most server motherboards, a critical vulnerability (CVE-2026-97631) has been addressed. The vulnerability exists in the PXE driver and can be exploited by sending specially crafted ICMP packets during network booting over IPv4 or IPv6 networks. The attack does not require authentication and allows an attacker to execute their code with UEFI firmware privileges before control is passed to the operating system, which can be used to bypass the UEFI Secure Boot verification mechanism and substitute malicious components during the boot process.<\/p>\n
The issue is caused by a buffer overflow in the ICMP message handler in the UefiPxeBcDxe driver, used for PXE booting, which receives ICMP packets during network booting to log network errors. The overflow occurs because the error messages are placed into a fixed-size buffer of 504 bytes without checking the actual size of the received data. If more than 504 bytes are sent in the ICMP packet, the excess tail is written beyond the buffer and overlaps with subsequent structures. <\/p>\n