Item

bediger4000 · 2026-10-27T21:39:50.000Z

This one seems weird. PXE-boot is such a fragile process in and off itself this doesn't strike me as end-of-the-world. If an attacker has enough presence on your network to send a targeted ICMP packet, they almost certainly could also fool around with your PXE-booting servers some other way.

michaelt · 2026-10-28T07:39:02.000Z

Yes - all the times I've seen PXE boot used, the usage has been "Hold F12 during boot to reformat the disk and re-install the OS from scratch"

Which is something that happens inside a trust boundary. After all, if an untrusted third party gets to install your OS it's game over, UEFI bug or not.

And consumer devices often don't have a network card - or come with PXE disabled in the BIOS.

crote · 2026-10-28T10:48:10.000Z

Some thin clients boot from PXE so they can forego local storage completely. Being able to update the entire fleet and completely prevent any kind of local changes with a simple reboot is a gamechanger for maintainability: you can be 100% certain that every "installation" is absolutely identical.

It also wasn't uncommon to install a server's hypervisor to a USB flash drive, or a tiny local SSD. Server motherboards with internal USB-A ports (not headers, the entire port) were quite common, and there were even IDE flash drives you could plug straight into the motherboard. This allowed you to completely dedicate the regular storage to the client VMs. I would not be surprised if that same market also used PXE for the same reason in larger installations.

jeroenhd · 2026-10-28T11:32:37.000Z

PXE can be great for stacks of virtual machines or thin client setups.

PXE has been enabled by default on most devices I bought, but only after USB and SSD boot failed, so in practice it's not really something you're going to see a lot of.

mjg59 · 2026-10-28T06:00:25.000Z

Yeah I'm actually not terribly worried about the server scenario, but having a way to get code exec in the firmware lets you defeat measured boot, which means this is a Bitlocker bypass in the default config.

reorder9695 · 2026-10-28T07:50:40.000Z

Would this mean any TPM based decryption keys could potentially be compromised in this kind of attack? E.g. when they're used for LUKS disk encryption.

mjg59 · 2026-10-28T08:02:00.000Z

Yup, if there's no passphrase involved.

rocqua · 2026-10-28T12:38:44.000Z

Even if there is a passphrase, this would likely allow for brute-forcing it.

mjg59 · 2026-10-28T15:30:54.000Z

No, you'll still have the TPM's dictionary attack lockout.

amluto · 2026-10-28T01:48:33.000Z

Except that a sensible deployment of PXE boot would also have the servers attest to their state prior to giving them any secrets. This vulnerability breaks this workflow.

octoberfranklin · 2026-10-28T01:43:21.000Z

Yeah but that just lets them replace the OS that gets booted.

This gives the attacker access at the UEFI level and above -- they can use it to produce false attestations.

vintermann · 2026-10-28T05:12:12.000Z

Do any of the locked down consoles or phones use a vulnerable UEFI implementation by any chance?

mschuster91 · 2026-10-28T07:20:20.000Z

Phones most commonly use their own bootloader stack.

mjg59 · 2026-10-28T07:27:37.000Z

UEFI is pretty common on phones now, but it's unlikely that any of them are running this network stack there.

yjftsjthsd-h · 2026-10-28T07:37:37.000Z

Is it? I'd like a UEFI phone booting GNU/Linux but last I looked it was a bunch of hacky aftermarket firmwares.

PS your profile links a blog that says you moved

mjg59 · 2026-10-28T08:01:34.000Z

It being UEFI doesn't mean it's a standard platform, there's no ACPI and you're going to need a custom kernel that targets that specific device. UEFI alone isn't enough to support booting a generic OS.

And thanks! Updated my profile.

fn-mote · 2026-10-28T11:40:19.000Z

Exactly. No phones have PXE boot enabled, regardless of the rest.