Abstract:
The open source UEFI firmware project TianoCore EDK II recently disclosed a serious security vulnerability that allows an attacker to send specially crafted data packets and trigger memory corruption during the device boot process over the network to cause boot interruption. If an attacker has the target firmware build information, it is also possible to execute code before the operating system is loaded.
The vulnerability, numbered CVE-2026-97631, mainly affects servers using TianoCore UEFI firmware. The upstream fix code has been merged on October 15, but servers and devices also need to obtain firmware updates containing the fix, which may require related software and OEM adaptation releases.
UEFI is the underlying firmware that runs when a device boots, responsible for initializing the hardware and loading subsequent boot components. TianoCore EDK II is a widely used open source UEFI implementation. Hardware manufacturers and cloud service providers will build their own UEFI boot firmware based on this project.
This vulnerability occurs in the PXE Base Code driver. PXE allows devices to obtain the programs required for startup from the network. It is commonly used in server deployment, system installation and recovery in data centers. When the device is PXE booted over IPv4/v6, the driver will receive ICMP error messages from the network, and the error messages will then be copied to a fixed-size buffer.
TianoCore said in the announcement that the affected code has a bug in its handling of data lengths and shard offsets: messages exceeding 504 bytes may write out buffer boundaries and overwrite adjacent memory. An attacker would need to send a specially crafted ICMP error message to the device's IP address during the time window when the target device is undergoing a PXE boot.
TianoCore EDK II is the basic code for many UEFI firmware products. AMI, Insyde, Phoenix and other manufacturers are using this project, and Microsoft is also developing the Project Mu project based on TianoCore EDK II.
The project team mentioned in the announcement that vulnerability impact assessment needs to be combined with specific devices: administrators need to check whether the firmware contains the affected PXE driver, whether the device will boot through the network, etc. Specific administrators need to contact the device manufacturer for consultation based on the server type. The device manufacturer needs to obtain the latest firmware and rebuild its own UEFI firmware.
Until a firmware fix is obtained, administrators can disable PXE boot. If PXE boot is necessary, the boot network can be placed on a trusted and isolated network segment to limit unauthorized ICMPv4/v6 traffic.
Comments