all InfoSec news
VU#811862: Image files in UEFI can be abused to modify boot behavior
CERT Recently Published Vulnerability Notes kb.cert.org
Overview
Implementation of Unified Extensible Firmware Interface (UEFI) by Vendors provide a way to customize logo image displayed during the early boot phase. Binarly has uncovered vulnerabilities in the image parsing libraries that provide this capability. An attacker with local privileged access can exploit these vulnerability to modify UEFI settings.
Description
UEFI firmware provides an extensible interface between an operating system and hardware platform. UEFI software stores a number of settings and files in a customized Extensible Firmware Interface (EFI) …
access attacker binarly boot exploit files firmware image implementation interface libraries local logo parsing privileged privileged access uefi uncovered vendors vulnerabilities vulnerability