PixieFAIL – 9 UEFI Flaws Expose Computers to Remote Attacks

Hackers exploit UEFI flaws to gain unauthorized access to a system’s firmware, enabling them to implant persistent malware or manipulate the boot process.

This provides a stealthy entry point that allows attackers to bypass traditional security measures and maintain control over the compromised system.

Cybersecurity researchers at Quarkslab recently discovered “PixieFAIL” a set of 9 UEFI flaws that makes the computers vulnerable to remote attacks and network hijacking.

PixieFAIL – 9 UEFI Flaws

These nine vulnerabilities affect the IPv6 network protocol stack of EDK II, TianoCore’s open-source reference implementation of UEFI.

Free Webinar

Fastrack Compliance: The Path to ZERO-Vulnerability

Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month. Delays in fixing these vulnerabilities lead to compliance issues, these delay can be minimized with a unique feature on AppTrana that helps you to get “Zero vulnerability report” within 72 hours.

Register for Free

EDK II’s network stack vulnerabilities surface during network boot in enterprise systems.

This method is common in data centers and HPC environments that streamline OS and software deployment to numerous compute nodes. 

UEFI’s IP stack in the early boot phase exposes a security risk from local network attacks.

PXE was born in 1998 by Intel, and it facilitates network booting through protocols like DHCP, UDP, and TFTP. 

It is incorporated into UEFI, and it expanded to IPv6 in 2010 to broaden the attack surface with additional protocols.

Tianocore’s EDK II is an open-source UEFI implementation that attracts developers for their own projects.

Exploring remote-triggered UEFI vulnerabilities raises questions about potential exploitation and persistence.

For network boot, a client fetches code in stages via TFTP. DHCP enables IP config and Boot Server list retrieval. PXE uses separate DHCP and proxy DHCP services to avoid modifying existing DHCP servers. 

The client selects a Boot Server, obtains NBP parameters, downloads, verifies, and executes. PXE over IPv6 involves DHCPv6 and TFTP and requires a functioning DNS protocol for Boot Server hostnames.

PXE boot process (Source – Quarkslab)

Vendors Affected

Here below, we have mentioned all the vendors that are affected:-

• Tianocore EDK II UEFI implementation
• Arm Ltd
• Insyde Software
• American Megatrends Inc. (AMI)
• Phoenix Technologies Inc
• Microsoft Corporation

Vulnerabilities Detected

Here below, we have mentioned all the vulnerabilities:-

• CVE-2023-45229: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message
• CVE-2023-45230: Buffer overflow in the DHCPv6 client via a long Server ID option
• CVE-2023-45231: Out of Bounds read when handling an ND Redirect message with truncated options
• CVE-2023-45232: Infinite loop when parsing unknown options in the Destination Options header
• CVE-2023-45233: Infinite loop when parsing a PadN option in the Destination Options header
• CVE-2023-45234: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message
• CVE-2023-45235: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message
• CVE-2023-45236: Predictable TCP Initial Sequence Numbers
• CVE-2023-45237: Use of a Weak PseudoRandom Number Generator

Make sure to remain vigilant and always use robust security solutions to mitigate threats like this and shield your network.

Try Kelltron’s cost-effective penetration testing services to evaluate digital systems security. available.