9.5-Severity UEFI Flaw Exposes Most Servers to Pre-Boot Code Execution

The vulnerability sits in an ICMP component of EDK II, an open-source codebase that hardware makers and cloud providers use to build the UEFI firmware that runs during the boot sequence. Ars Technica reported that virtually all UEFI suppliers, including AMI, Insyde and Phoenix, use the reference code extensively, and that Project Mu, Microsoft’s hardened EDK2 fork, used the code containing the vulnerable component as well.

Attackers can exploit the flaw to execute code before the operating system and firmware can enforce protections such as Secure Boot, which establishes a chain of trust for all code loaded during boot, including the Trusted Platform Module. The final payloads delivered through the vulnerability have no persistence and run only once, according to the report, but they can give attackers an opening to install other payloads that run each time early in the boot process.

Slashdot, citing Ars Technica, reported that Alex Matrosov of Anthropic and Dan Holmes of Google discovered the vulnerability and arranged for it to remain under wraps until a coordinated disclosure scheduled for January. AMI, a maker of motherboards and other hardware, published a pull request last month that detailed the vulnerability and included a code fix. After the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.

With publicly available patch code, Ars Technica reported, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits. Patching UEFI code vulnerabilities is cumbersome and time-consuming across millions of end devices sold and used by thousands of hardware makers and cloud providers, adding to the urgency.