In TianoCore EDK II (EFI Development Kit II), an open reference implementation of UEFI used in most server motherboards, a critical vulnerability (CVE-2026-97631) has been addressed. The vulnerability exists in the PXE driver and can be exploited by sending specially crafted ICMP packets during network booting in IPv4 or IPv6 networks. The attack requires no authentication and allows an attacker to execute their code with UEFI firmware privileges before control is handed over to the operating system, which can be used to bypass the UEFI Secure Boot verification mechanism and substitute malicious components at boot time.
The issue is caused by a buffer overflow in the ICMP message handler in the UefiPxeBcDxe driver, which is used for PXE booting and receives ICMP packets during network loading to capture network errors. The overflow occurs because incoming error messages are placed in a fixed 504-byte buffer without checking the actual size of the received data. If more than 504 bytes are sent in the ICMP packet, the overflowing tail is written outside the buffer and overwrites subsequent structures.
An attack can be conducted from the global network ā it is sufficient to know the IP address of the victim and determine the moment of PXE booting. Knowing which specific firmware is used on de server the victim, the attacker can prepare an exploit considering the placement of structures in the memory of a specific firmware build and exploit the vulnerability to execute code at the DXE (Driver Execution Environment) level, which runs in the zero protection ring.
The EDK II project was opened in 2004 by Intel and is used by all major firmware manufacturers for server systems, data centers, and cloud providers. Among other things, it is used in AMI, Insyde, and Phoenix firmware. The vulnerabilities are also present in firmware based on Microsoftās Mu platform, which is a fork of EDK II.
Het probleem is vastgesteld door vertegenwoordigers van de bedrijven Anthropic en Google, en er is een gecoƶrdineerde publieke onthulling gepland voor januari 2027. Maar de informatie moest eerder worden onthuld, omdat een ingenieur van AMI per ongeluk het embargo heeft overtreden en een publieke pull-request met een fix heeft gepubliceerd, waarop kan worden afgeleid wat de kern van de kwetsbaarheid is.
Bron: opennet.ru
