3 ms·

TIL: It's possible for UEFI code to access the internet. What could possibly go wrong?

p_l 5y ago
How did you think netbooting support works? UEFI made it quite simpler by making it so that network cards only have to bring a driver in OPROM instead of whole stack as before, and this allowed important improvements into boot process (like HTTPS instead of TFTP)
- secondcoming 5y ago
  I thought that was the Intel ME thing. I've actually never used netboot.
rvz 5y ago
> TIL: It's possible for UEFI code to access the internet. Quite surprising to see lots of tech-oriented users here finally discovering UEFI having access to the internet after years of even the basics like "Internet Recovery" being used on Apple Macs or even sysadmins using netbooting on diskless systems. There is always a IP/Net stack section in the UEFI menu on nearly every modern PC which gives you this hint, but it isn't useful for the 95% of users, except for sysadmins, recovery, security and even malware writers. > What could possibly go wrong? Indeed. A lot can go wrong. I bet someone will do a Wordle clone in UEFI next.
dheera 5y ago
Wasn't it always possible? If it can boot a full-blown OS that can access the internet, it has to be able to access the internet on its own.
- smw 5y ago
  I think your logic is faulty here. There were BIOSes with no ip stack for many years that could boot OSes that did have the ability to access the internet. Also, it's possible to remove the ip stack from most UEFI implementations? Now, it does need a network stack if it's going to _boot_ the other OS from the network.
- deleted 5y ago
  [deleted]
selfhoster11 5y ago
PXE boot has been supported since before UEFI was a thing.
base20 5y ago
How about this heap overflow bug in the UEFI bitmap (BMP) library: https://nvd.nist.gov/vuln/detail/CVE-2021-38577 https://nvd.nist.gov/vuln/detail/CVE-2021-38577 Exploitable via network, no user interaction and no special privileges required. Scores 9.8 on a scale of 10 for severity from NIST. That's what happens when this stuff is done in such a highly privileged environment - simple bugs become security nightmares. For comparison, Heartbleed scored a 7.5: https://nvd.nist.gov/vuln/detail/CVE-2014-0160 https://nvd.nist.gov/vuln/detail/CVE-2014-0160 Secure boot and signed firmware won't save you, and in fact it could make things worse since it means even well-informed and capable users won't be able to fix it on their own. They're utterly helpless until their vendor fixes it and publishes an update.

p_l 5y ago

How did you think netbooting support works? UEFI made it quite simpler by making it so that network cards only have to bring a driver in OPROM instead of whole stack as before, and this allowed important improvements into boot process (like HTTPS instead of TFTP)

secondcoming 5y ago
I thought that was the Intel ME thing. I've actually never used netboot.

rvz 5y ago

> TIL: It's possible for UEFI code to access the internet. Quite surprising to see lots of tech-oriented users here finally discovering UEFI having access to the internet after years of even the basics like "Internet Recovery" being used on Apple Macs or even sysadmins using netbooting on diskless systems. There is always a IP/Net stack section in the UEFI menu on nearly every modern PC which gives you this hint, but it isn't useful for the 95% of users, except for sysadmins, recovery, security and even malware writers. > What could possibly go wrong? Indeed. A lot can go wrong. I bet someone will do a Wordle clone in UEFI next.

dheera 5y ago

Wasn't it always possible? If it can boot a full-blown OS that can access the internet, it has to be able to access the internet on its own.

smw 5y ago
I think your logic is faulty here. There were BIOSes with no ip stack for many years that could boot OSes that did have the ability to access the internet. Also, it's possible to remove the ip stack from most UEFI implementations? Now, it does need a network stack if it's going to _boot_ the other OS from the network.
deleted 5y ago
[deleted]

selfhoster11 5y ago

PXE boot has been supported since before UEFI was a thing.

base20 5y ago

How about this heap overflow bug in the UEFI bitmap (BMP) library: https://nvd.nist.gov/vuln/detail/CVE-2021-38577 https://nvd.nist.gov/vuln/detail/CVE-2021-38577 Exploitable via network, no user interaction and no special privileges required. Scores 9.8 on a scale of 10 for severity from NIST. That's what happens when this stuff is done in such a highly privileged environment - simple bugs become security nightmares. For comparison, Heartbleed scored a 7.5: https://nvd.nist.gov/vuln/detail/CVE-2014-0160 https://nvd.nist.gov/vuln/detail/CVE-2014-0160 Secure boot and signed firmware won't save you, and in fact it could make things worse since it means even well-informed and capable users won't be able to fix it on their own. They're utterly helpless until their vendor fixes it and publishes an update.