UEFIs booting Windows and Linux devices can be hacked by malicious logo images.

UEFIs booting Windows and Linux devices can be hacked by malicious logo images.

Dan Goodin - 12/6/2023, 3:02 PM

  • taladar@sh.itjust.works
    252·
    11 months ago

    That is a terrible article that leaves out pretty much everything important about the actual exploit and instead has lots of general information that most people who would be in the position to have to patch this on large numbers of machines already know.

    Edit: nevermind, it is just a case of those multi-page articles for advertising reasons.

      • AtmaJnana@lemmy.world
        9·
        11 months ago

        FTA, emphasis mine:

        “The flaw exists in the processing of user-supplied splash screen during system boot, which can be exploited by an attacker who has physical access to the device,” according to the notification, which noted that an updated version is available. “By supplying a malicious splash screen, the attacker can cause a denial-of-service attack or execute arbitrary code in the UEFI DXE phase, bypassing the Secure Boot mechanism and compromising the system integrity.”

        Sure, but physical access is already no bueno.

        I wonder whether this could also be exploited remotely. IIRC, my mainboard vendor provides software to update the boot logo from within the OS. I don’t think it requires any physical interaction. It does require admin rights tho.

        • anonymouse@lemmings.worldEnglish
          5·
          11 months ago

          “There are several ways to exploit LogoFAIL. Remote attacks work by first exploiting an unpatched vulnerability in a browser, media player, or other app and using the administrative control gained to replace the legitimate logo image processed early in the boot process with an identical-looking one that exploits a parser flaw. The other way is to gain brief access to a vulnerable device while it’s unlocked and replace the legitimate image file with a malicious one.”

          • AtmaJnana@lemmy.world
            1·
            11 months ago

            That’s what I get for reading it on mobile while parenting. Lol. Thanks, I obviously missed that.