PixieFAIL – 9 UEFI Flaws Expose Computers to Remote Attacks

Hackers exploit UEFI flaws to gain unauthorized access to a system’s firmware, enabling them to implant persistent malware or manipulate the boot process.



This provides a stealthy entry point that allows attackers to bypass traditional security measures and maintain control over the compromised system.



Cybersecurity researchers at Quarkslab recently discovered “PixieFAIL” a set of 9 UEFI flaws that makes the computers vulnerable to remote attacks and network hijacking.



PixieFAIL – 9 UEFI Flaws



These nine vulnerabilities affect the IPv6 network protocol stack of EDK II, TianoCore’s open-source reference implementation of UEFI.






Document

@import url('https://fonts.googleapis.com/css2?family=Poppins&display=swap');
@import url('https://fonts.googleapis.com/css2?family=Poppins&family=Roboto&display=swap');
*{
margin: 0; padding: 0;
text-decoration: none;
}
.container{
font-family: roboto, sans-serif;
width: 90%;
border: 1px solid lightgrey;
padding: 20px;
background: linear-gradient(2deg,#E0EAF1 100%,#BBD2E0 100%);
margin: 20px auto ;
border-radius: 40px 10px;
box-shadow: 5px 5px 5px #e2ebff;
}
.container:hover{
box-shadow: 10px 10px 5px #e2ebff;

}
.container .title{
color: #015689;
font-size: 22px;
font-weight: bolder;
}
.container .title{
text-shadow: 1px 1px 1px lightgrey;
}
.container .title:after {
width: 50px;
height: 2px;
content: ' ';
position: absolute;
background-color: #015689;
margin: 20px 8px;
}
.container h2{
line-height: 40px;
margin: 2px 0;
font-weight: bolder;
}
.container a{

color: #170d51;
}
.container p{
font-size: 18px;
line-height: 30px;

}

.container button{
padding: 15px;
background-color: #4469f5;
border-radius: 10px;
border: none;
background-color: #00456e ;
font-size: 16px;
font-weight: bold;
margin-top: 5px;
}
.container button:hover{
box-shadow: 1px 1px 15px #015689;
transition: all 0.2S linear;

}
.container button a{
color: white;
}
hr{
/ display: none; /
}

Free Webinar

Fastrack Compliance: The Path to ZERO-Vulnerability
Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month. Delays in fixing these vulnerabilities lead to compliance issues, these delay can be minimized with a unique feature on AppTrana that helps you to get “Zero vulnerability report” within 72 hours.

Register for Free

EDK II’s network stack vulnerabilities surface during network boot in enterprise systems.



This method is common in data centers and HPC environments that streamline OS and software deployment to numerous compute nodes. 



UEFI’s IP stack in the early boot phase exposes a security risk from local network attacks.



PXE was born in 1998 by Intel, and it facilitates network booting through protocols like DHCP, UDP , and TFTP. 



It is incorporated into UEFI, and it expanded to IPv6 in 2010 to broaden the attack surface with additional protocols.



Tianocore’s EDK II is an open-source UEFI implementation that attracts developers for their own projects.



Exploring remote-triggered UEFI vulnerabilities raises questions about potential exploitation and persistence.



For network boot, a client fetches code in stages via TFTP. DHCP enables IP config and Boot Server list retrieval. PXE uses separate DHCP and proxy DHCP services to avoid modifying existing DHCP servers. 



The client selects a Boot Server, obtains NBP parameters, downloads, verifies, and executes. PXE over IPv6 involves DHCPv6 and TFTP and requires a functioning DNS protocol for Boot Server hostnames.






PXE boot process (Source – Quarkslab)



Vendors Affected



Here below, we have mentioned all the vendors that are affected:-



Tianocore EDK II UEFI implementation



Arm Ltd



Insyde Software



American Megatrends Inc. (AMI)



Phoenix Technologies Inc



Microsoft Corporation
Vulnerabilities Detected



Here below, we have mentioned all the vulnerabilities:-



CVE-2023-45229: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message



CVE-2023-45230: Buffer overflow in the DHCPv6 client via a long Server ID option



CVE-2023-45231: Out of Bounds read when handling an ND Redirect message with truncated options



CVE-2023-45232: Infinite loop when parsing unknown options in the Destination Options header



CVE-2023-45233: Infinite loop when parsing a PadN option in the Destination Options header



CVE-2023-45234: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message



CVE-2023-45235: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message



CVE-2023-45236: Predictable TCP Initial Sequence Numbers



CVE-2023-45237: Use of a Weak PseudoRandom Number Generator
Make sure to remain vigilant and always use robust security solutions to mitigate threats like this and shield your network.



Try Kelltron’s cost-effective penetration testing services to evaluate digital systems security. Free demo available.
The post PixieFAIL – 9 UEFI Flaws Expose Computers to Remote Attacks appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform .