Critical pre-boot RCE in EDK II PXE driver: one crafted packet hijacks servers before Secure Boot
cyb3rops · x · 2026-10-28
Anthropic and Google researchers disclosed CVE-2026-97631 (GHSA-99cj-7hg9-mp4m), a critical flaw in the PXE driver of TianoCore EDK II UEFI firmware found in most servers. During PXE boot over IPv4/IPv6, an unauthenticated attacker who can deliver an ICMP error message can corrupt DXE-phase memory and execute arbitrary code before the OS loads or Secure Boot verifies anything: the receive path copies messages into a fixed 504-byte Mode.IcmpError field with broken bounds handling, and advances the destination pointer by cumulative rather than per-fragment length. Impact ranges from deterministic boot hangs to ring-0 code dispatch via CoreSignalEvent() before any OS security control exists. EDK II master (as of 2026-09-14) is not yet patched; fix PR #13002 is pending.
More from Infra
- Porcupine-like heatsink found inside Calnex Rb/GPS frequency reference during Noctua fan swap — Pytlicek · 2026-10-28
- Unverified: sub-1GB quantized text models reportedly run on phones, VLM rivals Flash Lite class — JosephJacks_ · 2026-10-28
- Screenless M1 Airs at $30 per 1,000 multicore points spark cheap Mac cluster idea — vincent_koc · 2026-10-28
- RTX 3080 Tensor Core unlock claims 80-87% TFLOPS boost, RTX 50 series blocked — Revolutionalredstone · 2026-10-28
- CXMT to start small-scale HBM3E production within two months, yield at 20% — zephyr_z9 · 2026-10-28
- Video Transcription Costs Under 1 Yuan per Hour, CPU Free but Error-Prone — huangyun_122 · 2026-10-28