Item

octoberfranklin · 2026-10-28T01:43:21.000Z

Yeah but that just lets them replace the OS that gets booted.

This gives the attacker access at the UEFI level and above -- they can use it to produce false attestations.

vintermann · 2026-10-28T05:12:12.000Z

Do any of the locked down consoles or phones use a vulnerable UEFI implementation by any chance?

mschuster91 · 2026-10-28T07:20:20.000Z

Phones most commonly use their own bootloader stack.

mjg59 · 2026-10-28T07:27:37.000Z

UEFI is pretty common on phones now, but it's unlikely that any of them are running this network stack there.

yjftsjthsd-h · 2026-10-28T07:37:37.000Z

Is it? I'd like a UEFI phone booting GNU/Linux but last I looked it was a bunch of hacky aftermarket firmwares.

PS your profile links a blog that says you moved

mjg59 · 2026-10-28T08:01:34.000Z

It being UEFI doesn't mean it's a standard platform, there's no ACPI and you're going to need a custom kernel that targets that specific device. UEFI alone isn't enough to support booting a generic OS.

And thanks! Updated my profile.

fn-mote · 2026-10-28T11:40:19.000Z

Exactly. No phones have PXE boot enabled, regardless of the rest.