- This week, QuarksLab security researchers published the details and the proofs of concept of nine vulnerabilities they discovered in August 2023 after several delays.
- In the proper context, the vulnerabilities can allow threat actors to carry out multiple types of cyber attacks, including remote code execution, denial of service, and more.
- Patches for the bugs are yet to reach impacted machines, once more exposing the firmware supply chain.
QuarksLab security researchers Ivan Arce and Francisco Falcon have spotted several security vulnerabilities in the de-facto open-source implementation of the Unified Extensible Firmware Interface (UEFI) used in computers.
Dubbed PixieFail, the nine vulnerabilities reside in the TianoCore EDK II implementation of UEFI, threatening exploitation at the firmware level. Successful exploitation, possible during the network boot process, can enable threat actors to carry out denial of service attacks, perform information leakage, remote code execution, poison the DNS cache, and hijack network sessions.
UEFI firmware is responsible for performing system boot on almost all present-day computers. “In order to boot from the network, a…
