{"id":184024,"date":"2026-10-28T23:40:36","date_gmt":"2026-10-28T21:40:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-uefi-proshivkah-ekspluatiruemaya-cherez-otpravku-icmp-paketa"},"modified":"2026-10-28T23:40:41","modified_gmt":"2026-10-28T21:40:41","slug":"remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","title":{"rendered":"Fj\u00e4rrs\u00e5rbarhet i serverns UEFI-firmware, utnyttjad genom att skicka ICMP-paket","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I TianoCore EDK II (EFI Development Kit II), en \u00f6ppen referensimplementation av UEFI som anv\u00e4nds i de flesta servermoderkort, har en kritisk s\u00e5rbarhet \u00e5tg\u00e4rdats (CVE-2026-97631). S\u00e5rbarheten finns i PXE-drivrutinen och kan utnyttjas genom att skicka s\u00e4rskilt utformade ICMP-paket under n\u00e4tverksstart i IPv4- eller IPv6-n\u00e4tverk. Attacken kr\u00e4ver ingen autentisering och g\u00f6r det m\u00f6jligt f\u00f6r en angripare att k\u00f6ra sin kod med UEFI-firmwareprivilegier innan kontrollen \u00f6verl\u00e4mnas till operativsystemet, vilket kan anv\u00e4ndas f\u00f6r att kringg\u00e5 UEFI Secure Boot-verifieringsmekanismen och inf\u00f6ra skadliga komponenter under startprocessen.<\/p>\n

Problemet orsakas av en buffert\u00f6verfl\u00f6desattack i ICMP-meddelandeshanteraren i UefiPxeBcDxe-drivrutinen, som anv\u00e4nds f\u00f6r PXE-start och tar emot ICMP-paket under n\u00e4tstart f\u00f6r att registrera n\u00e4tverksfel. \u00d6verfl\u00f6det uppst\u00e5r p\u00e5 grund av att mottagna felmeddelanden placeras i en fast buffer med en storlek p\u00e5 504 byte utan att kontrollera den faktiska storleken p\u00e5 de mottagna data. Om mer \u00e4n 504 byte skickas i ICMP-paketet skrivs det \u00f6verfl\u00f6diga slutet utanf\u00f6r bufferten och p\u00e5verkar efterf\u00f6ljande strukturer. <\/p>\n

En attack kan genomf\u00f6ras fr\u00e5n det globala n\u00e4tverket \u2014 det r\u00e4cker att veta IP-adressen till offret och kunna best\u00e4mma tidpunkten f\u00f6r PXE-boot. Genom att veta vilken specifik firmware som anv\u00e4nds p\u00e5 servern<\/a> offret kan angriparen f\u00f6rbereda en exploit med beaktande av placeringen av strukturer i minnet i den specifika firmware-versionen och utnyttja s\u00e5rbarheten f\u00f6r att k\u00f6ra kod p\u00e5 DXE-niv\u00e5 (Driver Execution Environment), som k\u00f6rs i kernelzoon niv\u00e5 0. <\/p>\n

EDK II-projektet \u00f6ppnades 2004 av Intel och anv\u00e4nds av alla stora firmware-tillverkare f\u00f6r serversystem, datacenter och molnleverant\u00f6rer. Bland annat anv\u00e4nds det i AMI-, Insyde- och Phoenix-firmwares. S\u00e5rbarheten finns ocks\u00e5 i firmware baserade p\u00e5 Microsofts Mu-plattform, som \u00e4r en fork av EDK II.<\/p>\n

Problemet uppt\u00e4cktes av representanter fr\u00e5n Anthropic och Google och en offentlig avsl\u00f6jande har planerats till januari 2027. Men informationen m\u00e5ste offentligg\u00f6ras tidigare, eftersom en ingenj\u00f6r fr\u00e5n AMI av misstag br\u00f6t embargoet och publicerade en offentlig pull-beg\u00e4ran med en l\u00f6sning som gjorde det m\u00f6jligt att f\u00f6rst\u00e5 sj\u00e4lva s\u00e5rbarheten.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 TianoCore EDK II (EFI Development Kit II), \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 UEFI, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-97631). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 PXE \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 ICMP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432 \u0441\u0435\u0442\u044f\u0445 IPv4 \u0438\u043b\u0438 IPv6. \u0410\u0442\u0430\u043a\u0430 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184024","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Fj\u00e4rrs\u00e5rbarhet i server UEFI-firmware som utnyttjas genom att skicka ICMP-paket | ProHoster","description":"I TianoCore EDK II (EFI Development Kit II), den \u00f6ppna referensimplementationen av UEFI som anv\u00e4nds i de flesta servermoderkort, har en kritisk s\u00e5rbarhet \u00e5tg\u00e4rdats (CVE-2026-97631).","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 ICMP-\u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0412 TianoCore EDK II (EFI Development Kit II), \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 UEFI, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-97631).","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-28T21:40:36+00:00","article:modified_time":"2026-10-28T21:40:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/184024","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=184024"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/184024\/revisions"}],"predecessor-version":[{"id":184025,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/184024\/revisions\/184025"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=184024"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=184024"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=184024"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}