Hackers exploit UEFI flaws to gain unauthorized access to a system’s firmware, enabling them to implant persistent malware or manipulate the boot process.
This provides a stealthy entry point that allows attackers to bypass traditional security measures and maintain control over the compromised system.
Cybersecurity researchers at Quarkslab recently discovered “PixieFAIL” a set of 9 UEFI flaws that makes the computers vulnerable to remote attacks and network hijacking.
PixieFAIL – 9 UEFI Flaws
These nine vulnerabilities affect the IPv6 network protocol stack of EDK II, TianoCore’s open-source reference implementation of UEFI.
Document
@import url('https://fonts.googleapis.com/css2?family=Poppins&display=swap');
@import url('https://fonts.googleapis.com/css2?family=Poppins&family=Roboto&display=swap');
*{
margin: 0; padding: 0;
text-decoration: none;
}
.container{
font-family: roboto, sans-serif;
width: 90%;
border: 1px solid lightgrey;
padding: 20px;
background: linear-gradient(2deg,#E0EAF1 100%,#BBD2E0 100%);
margin: 20px auto ;
border-radius: 40px 10px;
box-shadow: 5px 5px 5px #e2ebff;
}
.container:hover{
box-shadow: 10px 10px 5px #e2ebff;
}
.container .title{
color: #015689;
font-size: 22px;
font-weight: bolder;
}
.container .title{
text-shadow: 1px 1px 1px lightgrey;
}
.container .title:after {
width: 50px;
height: 2px;
content: ' ';
position: absolute;
background-color: #015689;
margin: 20px 8px;
}
.container h2{
line-height: 40px;
margin: 2px 0;
font-weight: bolder;
}
.container a{
color: #170d51;
}
.container p{
font-size: 18px;
line-height: 30px;
}
.container button{
padding: 15px;
background-color: #4469f5;
border-radius: 10px;
border: none;
background-color: #00456e ;
font-size: 16px;
font-weight: bold;
margin-top: 5px;
}
.container button:hover{
box-shadow: 1px 1px 15px #015689;
transition: all 0.2S linear;
}
.container button a{
color: white;
}
hr{
/ display: none; /
}
Free Webinar
Fastrack Compliance: The Path to ZERO-Vulnerability
Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month. Delays in fixing these vulnerabilities lead to compliance issues, these delay can be minimized with a unique feature on AppTrana that helps you to get “Zero vulnerability report” within 72 hours.
Register for Free
EDK II’s network stack vulnerabilities surface during network boot in enterprise systems.
This method is common in data centers and HPC environments that streamline OS and software deployment to numerous compute nodes.
UEFI’s IP stack in the early boot phase exposes a security risk from local network attacks.
PXE was born in 1998 by Intel, and it facilitates network booting through protocols like DHCP, UDP , and TFTP.
It is incorporated into UEFI, and it expanded to IPv6 in 2010 to broaden the attack surface with additional protocols.
Tianocore’s EDK II is an open-source UEFI implementation that attracts developers for their own projects.
Exploring remote-triggered UEFI vulnerabilities raises questions about potential exploitation and persistence.
For network boot, a client fetches code in stages via TFTP. DHCP enables IP config and Boot Server list retrieval. PXE uses separate DHCP and proxy DHCP services to avoid modifying existing DHCP servers.
The client selects a Boot Server, obtains NBP parameters, downloads, verifies, and executes. PXE over IPv6 involves DHCPv6 and TFTP and requires a functioning DNS protocol for Boot Server hostnames.
PXE boot process (Source – Quarkslab)
Vendors Affected
Here below, we have mentioned all the vendors that are affected:-
Tianocore EDK II UEFI implementation
Arm Ltd
Insyde Software
American Megatrends Inc. (AMI)
Phoenix Technologies Inc
Microsoft Corporation
Vulnerabilities Detected
Here below, we have mentioned all the vulnerabilities:-
CVE-2023-45229: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message
CVE-2023-45230: Buffer overflow in the DHCPv6 client via a long Server ID option
CVE-2023-45231: Out of Bounds read when handling an ND Redirect message with truncated options
CVE-2023-45232: Infinite loop when parsing unknown options in the Destination Options header
CVE-2023-45233: Infinite loop when parsing a PadN option in the Destination Options header
CVE-2023-45234: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message
CVE-2023-45235: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message
CVE-2023-45236: Predictable TCP Initial Sequence Numbers
CVE-2023-45237: Use of a Weak PseudoRandom Number Generator
Make sure to remain vigilant and always use robust security solutions to mitigate threats like this and shield your network.
Try Kelltron’s cost-effective penetration testing services to evaluate digital systems security. Free demo available.
The post PixieFAIL – 9 UEFI Flaws Expose Computers to Remote Attacks appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform .
