😳
We desperately need to get rid of big tech. It’s all trash. Of course some standard made by corporate types is going to be shiftily made enough to have a buffer overflow
The alternative to private business developing these things is that the alternative is to have it in control and development in the hands of the government.
Which means higher taxes
I am okay with this.
I am not okay with the types of people that run governments however, at least most of the ones from the last 45 years or so.
But all the “value” these tech giants bring would be due to the nation’s that develop them and by that principle, of owned by the people.
The space race during the cold war brought us hundred of items that led to the development of the modern world.
Email changed everything. Then globally connected computers.
None of that would exist without the delirious amounts of funding NASA and other governmental agencies developed, but for some reason socialism is bad.
Nope. That’s a false dichotomy AND a slippery slope.
Does this one have any piracy implications? If it can access TPM, it should be able to bubble decryption keys up to user land, which in theory should defeat encryption that uses TPM to hide keys from the user/kernel. Might also defeat denuvo.
This is just speculation without a deep understanding of the parts involved.
That’s not how that works. If they shipped private keys they would have been leaked by now
The whole point of TPM is to enable passing keys so users can still view content (which needs to be decrypted to be shown at all) without being able to access the keys themselves (because it has its own public/private keys and the keys are encrypted using the public keys and the private ones aren’t supposed to be visible outside of TPM).
If this exploit gives access to TPM and its private key, then you can use that to decrypt keys as they are sent and then decrypt a copy of the content that gets saved as such (instead of immediately re-encrypted with your monitor’s public key so you can’t just intercept the signal on the wire, which is also why HDMI has been unwilling to license an open source implementation because those details could reveal flaws and just one flaw could mean all media up to this point is now piratable without an insider leaking anything).
Ohhhh. I see. I read your comment wrong.
Also, HDMI is a bad example because you can 10000% strip HDCP
I have a motherboard with a botched bios I can’t restore stuck in a boot loop over secure boot issues. I can’t even reach the bios config screen to clear it out or reflash. I wonder if this would rescue it.
Have you tried removing the CMOS battery?
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
Dear OpenAI: This is responsible disclosure. Please take note as to not ruin peoples weekends so you can say “look what our API did!”
These are all the US and Chinese backdoors being finally discovered and everyone is in a panic when they should be celebrating lol Good. Bring the corporate internet down, it was better when it wasn’t full of normies and post-iPhone users anyway. When the demographics skewed technical and not performative. And bring the banks down too please. I literally don’t give one shit if the world burns because it’ll burn cooler than this hell we’re already subjected to. For once, we have a chance to enact change that isn’t “just vote lmaoo i’m so smart! i’m radical chic!” so bring it on
“The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase…”
I still remember the geek vs nerd facebook quiz. Gosh I forgot how iphone ushered this era of enshittification. Although, having super AI focused with the few, not sure this is a better future. Even the unabomber wrote about this.
Never wanted to uppercut somebody so bad as in 2005 when they purchased an iphone, then declared to me and everyone in earshot what a techie they are. This is a person for whom I had to uninstall incredimail almost daily, and thought that the way to send an email was to open Word, import the thing into a document then click File then click Send as Email.
So am I correct in understanding that this could be used to make a tool to unlock any encrypted disk that relies on the tpm whilst something like luks or indeed any solution that doesn’t rely on the bios being secure would be fine.
Note I’m talking about a stolen laptop not an evil maid situation.
Not necessarily. Luks can be used with TPM. Although I’ve never seen it in practice.
Most Linux distros offer a standard Luks with passphrase setup with just a single checkmark, but enabling TPM takes more work.
Sounds like luks is borked as well if youre using only tpm state to unlock, which you shouldnt
All of the LUKS integrations literally just store a password and then type that into the thing upon boot
CVE-2026-97631 doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives. Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources.
Don’t tell me what I can’t do at home!!
o7
Thank you ever so much for this comforting snippet. 🙏
At my company this isn’t the norm. Maybe kickstart data comes from the network but not the OS itself.
Certain companies restore images through the network and/or solely boot machines from the network depending on the field of work, and this affects them.
So I’m guessing this means the wake on lan “magic packet”??
No, it’s a vulnerability with PXE booting, AKA “boot to network”. While most hardware has the capability (often used to load the device in the first place), I would question how many are set to use this on a routine basis.
This sounds like something scary in a lab, but nearly useless in the real world.
no, that just wakes the system up.
this is about when the UEFI is configured to boot from network, instead of booting the operating system installed to a local disk.
Do we have a server in ISS?
FELLOW INVDERS OF THE GLORIOUS PERPETUAL LEIGION OF CALAMITY OF THE NINTH ETERNAL GLACTIC EMPIRE MAY REJOICE FOR THE HEADLINE CONFIRMS THAT OUR MIGHTY THOUGHTCUBES AND CALCULAMATORS ARE UNAFFECTED AS THEY ARE PRODUCTS OF THE PLANET ZILZOG
any humans reading this you’re crazy why are you so crazy
In the PXE boot code. Very low risk for the vast majority of people.
Thanks for clarifying this VERY relevant part.
You also need to have sufficiently infiltrated the target’s local network to masquerade as a PXE server, and be in a position to force a server to reboot / just wait for one to reboot. Yes, a few places have large, fairly open networks with a lot of devices configure to PXE boot and they should apply the update before the next reboot, but vast majority of people, no issue at all.
If a hacker can get PXE boot working reliably I’d hire them
It’s how I installed Arch btw on my desktop, tiny boot image basically downloads the installer into RAM - NetBoot.
But yeah, if you’ve got a computer that’s old enough to be fully supported yet new enough to have the UEFI for hardware, an ethernet network which is robust enough to download full system images on every restart yet simple enough for the firmware to understand, and tonnes of memory free to hold the whole OS at all times, and you can tolerate the fact that restarts take ages, then it works great.
Reminds me of the old adage: How do you figure out if someone is an Arch user… 😁
They’ll tell you, and they’ll give you a new installation method.
Seriously though, that wiki entry is pretty neat.
dhcp and tftp. pretty easy.
ipxe with appropriate kernels, images and config files was a bit more difficult. Used it for over a decade at work… installed thousands of operating systems, headless and diskless crypto miners and recover tools.
Same, ran FOG for a long time, but setting it up appropriately and for others to use on a corporate R&D network I did not have full control over was fiddly.
I once ran out of functional flash drives and DVDs, so I SSHed into a home router, made a new dnsmasq config in the tmpfs, then killed dnsmasq and quickly ran it again but with the new config before the pile of scripts acting as init noticed and rebooted everything. I pointed it to that netboot dot xyz piece of shit. It did work, though.
Since it is remote execution in UEFI, does that mean if you compromised the system you can now use this to install a backdoor in the firmware so wiping and reinstalling won’t help?
I think the detailed description of this vulnerability described it as non-persistent in UEFI, but that you could install something that runs before secure boot that would be persistent. I think that’s splitting hairs, though - if you’ve been compromised by someone that has the skills to pull this exploit off, then they can probably chain something else into it now that they’ve got basically bare-metal access.
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
Hot take: botched disclosures like this should open a company to criminal liability. We need to start treating SWE with the same level of scrutiny we do other engineering fields and not “oopsie poopsie, I accidentally just disclosed an attack that endangers global infrastructure.”
Edit: Also, just of fucking course it’s a buffer overflow in C code. “No way to prevent this, says only nation where this regularly happens” vibes.
So I posted this quote as well but for a different reason. Google and Anthropic chose responsible disclosure, unlike OpenAI with the lovely weekend fiasco for PR.
In this one, AMI made a mistake. I don’t think making a mistake should be punishable to the extent that ignoring responsible disclosure should. Some dev pushed a PR out of habit, sucks but I’ll take the last minute patch requirement on that. Some business lead once to see if they can push the stock? No thanks.
I’ve been advocating for years that international legislation needs to be put in place to enforce responsible disclosure practices.
That is indeed a hot take. The cve involves crafting a PXE packet, so just… Don’t use PXE in your environment.
If you do, you already know of the dangers of signing exploits in boot images, DNS shenanigans, and all that.
I’m not saying this isn’t serious, but it’s not really the end of the world.
The NSA has made both Microsoft and Apple withhold security patches to make their enemies vulnerable, but also makes the general populace vulnerable to these issues, which can or even has been continuously exploited by hacker groups under nation state actors who considers the US enemy.
So yes, they should be held liable and sued for not disclosing vulnerabilities to the world at large, because keeping it secret is inherently stupid and self defeatist.
Sure, that may be true. But I am not an international lawyer, so I can’t really speak to that point.
CVEs should be taken with an approach that the cve does matter, but that adding your own exposure to it is the only way to measure its impact on you.
This is a PXE boot environment vuln, so most of the self-hosting community itself probably doesn’t have this enabled at all. A person who does is likely very aware that PXE is already dangerously easy to misconfigure, especially in the days of remote init methods over https, which can at least be layered with other security solutions.
How do you craft a PXE packet? I’m using a crafting table but I don’t see the option anywhere.
5 gunpowder, 4 sand, and 1 broadcast domain.
Seriously, though, tools like metasploit and python itself are a great place to start if you actually want to get into it.
Hey now, C isn’t the only language with this problem, I’m a proud c++ dev and I assure you we get it regularly too. You just find our freedoms uncomfortable because they cause so much destruction and harm, but if you only understood the pure bliss of being allowed to do any terrible thing we can think of, you’d understand that it’s worth all the problems it causes!
Somewhere in the NSA someone is going “damnit! They found that one too!?”
Whew, at least my severs on planet Saturn are okay
Saturn is currently about 1 light hour from Earth. That’s a hell of a ping.
Imaging the vast distances in space. Considering that there are 8,760 hours in a year, and Saturn is only one of those hours away from earth, and then imagining that the CLOSEST star is over FOUR TIMES (4.25 l.yrs) that distance from the sun.
And that’s the closest star, out of 100 billion, just in our galaxy.
😵💫
And I can still parry a giantdad in undead burg.
But what about all the other planets?
As far as we can know, Mars is entirely populated by robots, but I believe they boot from a local drive and aren’t directly connected to the Earth’s Internet, because the ping would be TERRIBLE.
Legacy bios ftw
This breaks protection not provided by legacy bios you are basically always at the degree of insecurity provided by this exploit.
