A longstanding vulnerability in EDK II, the open-source code used extensively by hardware manufacturers for UEFI firmware, has been discovered. This flaw, present for 16 years, allows attackers to execute code on a system before the operating system starts, provided that the system is booting via network.
Understanding the UEFI Flaw
UEFI firmware initiates when a computer is powered on, predating the operating system’s boot. If attackers intercept the network during this boot phase, they can disrupt the boot process or potentially run their code before security measures like Secure Boot are activated. This vulnerability can be exploited without any passwords or prior access to the machine, but the attacker must be able to access the system over the network during the boot process.
Both Red Hat and SUSE, who include this code in their distributions, have indicated that the vulnerability is exploitable from a nearby network rather than over the internet. TianoCore, the project overseeing EDK II, rated this flaw with a severity of 9.5 out of 10, and while a fix has been developed, it has not been included in any stable EDK II release yet.
Technical Details of the Exploit
The flaw originates from a buffer overflow in the PXE network-boot code of EDK II. During a PXE boot, the system retrieves its startup image over the network, with the PXE driver handling network messages. However, due to improper size checks in both IPv4 and IPv6 versions, messages exceeding 504 bytes can overwrite adjacent memory, allowing an attacker to execute arbitrary code.
Exploiting this flaw requires sending a crafted error message during the network boot process. Although causing a system crash is straightforward, executing code is more complex and depends on the attacker knowing the specific firmware build. This code execution occurs before Secure Boot validations, making the flaw particularly critical.
Who is at Risk and Available Solutions
This vulnerability affects systems with network boot enabled, particularly servers and data center equipment. Home and office users who rely on local disk boots remain unaffected. The flaw has been present since a 2010 commit, and while a code fix has been integrated into the EDK II source code, no stable release includes it as of now.
Organizations using affected systems are advised to disable PXE network boot to mitigate risk. Monitoring network traffic during boot times is also recommended to detect any exploit attempts. Until firmware vendors issue updates based on the patched code, operators have limited options to apply immediate fixes.
The disclosure of this vulnerability was expedited when a public pull request detailed the flaw, prompting TianoCore to release an advisory earlier than planned. Although no current exploitation has been reported, the availability of the patch in the source code allows skilled attackers to develop exploits.
Future Implications and Precautionary Measures
While there is no indication of this flaw being actively exploited, it underscores the importance of regular firmware updates and vigilance in cybersecurity practices. This issue highlights the risks associated with network-booting systems and the need for comprehensive security protocols to protect sensitive infrastructure.
Organizations must stay informed about potential vulnerabilities and ensure that their systems are regularly patched and monitored. The timely integration of security fixes can prevent exploitation and secure systems against emerging threats.
