😳
CVE-2026-97631 doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives. Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources.
Thank you ever so much for this comforting snippet. 🙏
At my company this isn’t the norm. Maybe kickstart data comes from the network but not the OS itself.
Certain companies restore images through the network and/or solely boot machines from the network depending on the field of work, and this affects them.
So I’m guessing this means the wake on lan “magic packet”??
no, that just wakes the system up.
this is about when the UEFI is configured to boot from network, instead of booting the operating system installed to a local disk.
No, it’s a vulnerability with PXE booting, AKA “boot to network”. While most hardware has the capability (often used to load the device in the first place), I would question how many are set to use this on a routine basis.
This sounds like something scary in a lab, but nearly useless in the real world.
But what about all the other planets?
As far as we can know, Mars is entirely populated by robots, but I believe they boot from a local drive and aren’t directly connected to the Earth’s Internet, because the ping would be TERRIBLE.
This one appears to be sensationalist, but seeing bugs coming out of the woodwork in every layer of the stack makes you realize how vulnerable our giant tech stack is and always was. I think it’s time to hit reset and nuke the stack. Surely there is a way to create a low level, generic execution environment that doesn’t rely on this bloated ass stack. I don’t see why an application’s entire stack could not be auditable down to the machine instructions. Then, we wouldn’t all need access to super computers like today.
It has been entirely fucked since in inception and not just security wise. The entire tech stack is a nighare hodgepodge mess.
Hear hear. Convivial technology is the answer.
Whew, at least my severs on planet Saturn are okay
Saturn is currently about 1 light hour from Earth. That’s a hell of a ping.
And I can still parry a giantdad in undead burg.
Imaging the vast distances in space. Considering that there are 8,760 hours in a year, and Saturn is only one of those hours away from earth, and then imagining that the CLOSEST star is over FOUR TIMES (4.25 l.yrs) that distance from the sun.
And that’s the closest star, out of 100 billion, just in our galaxy.
😵💫
In the PXE boot code. Very low risk for the vast majority of people.
You also need to have sufficiently infiltrated the target’s local network to masquerade as a PXE server, and be in a position to force a server to reboot / just wait for one to reboot. Yes, a few places have large, fairly open networks with a lot of devices configure to PXE boot and they should apply the update before the next reboot, but vast majority of people, no issue at all.
If a hacker can get PXE boot working reliably I’d hire them
I once ran out of functional flash drives and DVDs, so I SSHed into a home router, made a new dnsmasq config in the tmpfs, then killed dnsmasq and quickly ran it again but with the new config before the pile of scripts acting as init noticed and rebooted everything. I pointed it to that netboot dot xyz piece of shit. It did work, though.
It’s how I installed Arch btw on my desktop, tiny boot image basically downloads the installer into RAM - NetBoot.
But yeah, if you’ve got a computer that’s old enough to be fully supported yet new enough to have the UEFI for hardware, an ethernet network which is robust enough to download full system images on every restart yet simple enough for the firmware to understand, and tonnes of memory free to hold the whole OS at all times, and you can tolerate the fact that restarts take ages, then it works great.
Since it is remote execution in UEFI, does that mean if you compromised the system you can now use this to install a backdoor in the firmware so wiping and reinstalling won’t help?
I think the detailed description of this vulnerability described it as non-persistent in UEFI, but that you could install something that runs before secure boot that would be persistent. I think that’s splitting hairs, though - if you’ve been compromised by someone that has the skills to pull this exploit off, then they can probably chain something else into it now that they’ve got basically bare-metal access.
Thanks for clarifying this VERY relevant part.
Somewhere in the NSA someone is going “damnit! They found that one too!?”
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
Hot take: botched disclosures like this should open a company to criminal liability. We need to start treating SWE with the same level of scrutiny we do other engineering fields and not “oopsie poopsie, I accidentally just disclosed an attack that endangers global infrastructure.”
Edit: Also, just of fucking course it’s a buffer overflow in C code. “No way to prevent this, says only nation where this regularly happens” vibes.
That is indeed a hot take. The cve involves crafting a PXE packet, so just… Don’t use PXE in your environment.
If you do, you already know of the dangers of signing exploits in boot images, DNS shenanigans, and all that.
I’m not saying this isn’t serious, but it’s not really the end of the world.
How do you craft a PXE packet? I’m using a crafting table but I don’t see the option anywhere.
5 gunpowder, 4 sand, and 1 broadcast domain.
Seriously, though, tools like metasploit and python itself are a great place to start if you actually want to get into it.
The NSA has made both Microsoft and Apple withhold security patches to make their enemies vulnerable, but also makes the general populace vulnerable to these issues, which can or even has been continuously exploited by hacker groups under nation state actors who considers the US enemy.
So yes, they should be held liable and sued for not disclosing vulnerabilities to the world at large, because keeping it secret is inherently stupid and self defeatist.
Sure, that may be true. But I am not an international lawyer, so I can’t really speak to that point.
CVEs should be taken with an approach that the cve does matter, but that adding your own exposure to it is the only way to measure its impact on you.
This is a PXE boot environment vuln, so most of the self-hosting community itself probably doesn’t have this enabled at all. A person who does is likely very aware that PXE is already dangerously easy to misconfigure, especially in the days of remote init methods over https, which can at least be layered with other security solutions.
Hey now, C isn’t the only language with this problem, I’m a proud c++ dev and I assure you we get it regularly too. You just find our freedoms uncomfortable because they cause so much destruction and harm, but if you only understood the pure bliss of being allowed to do any terrible thing we can think of, you’d understand that it’s worth all the problems it causes!
Ohhhh boy
Ok so just don’t turn computers on anymore. Got it 👍
And touch grass like some kind of freak?? You’ll have to fight me 🔪
The trick is to not turn off the computer in the first place
That’s what I do. And touch grass anyway.
In what? And you better not say Fortnite or some shit like that or i will come to your house with a bag full of fresh cut grass and dump it all over you!
In this case it’s fine as long you don’t reboot your server ever.
Venusian war begins.
Neat. So are legacy BIOS actually more secure at the moment? Weird to think about but very reminiscent of that one time almost every Gigabyte mobo had an exploit tied to its online update capability.
Only from this specific exploit
Yes, actual BIOSes have no network access. They had other issues though, like enough space to embed hidden persistent malware, writable from Windows.
What about Planet Phatt?
It would be ironic if AI used this exploit to turn itself and every computer on the planet off forever.
Like fuck this mess, I’m out. Peace.
Then we’d have to fix our own shit and start taking to each other instead of destroying each other.
