Several large bare-metal hosting companies. Not over the open Internet, but that doesn't matter if the management networks are shared and the price of admission a single server rental.

There is also HTTPS boot, which might be a lot more secure than PXE

https://tianocore-docs.github.io/EDKIIHttpsBootGettingStarte...

I would be concerned for e.g. Hetzner dedicated servers. They assumedly PXE-boot consumer grade UEFI hardware that is unlikely to have a dedicated management interface. Exploitability would depend on how well they filter ICMP within their network.

It's a pretty common setup on servers, even if it's not the majority. Probably more commonly it's part of the boot sequence on servers even if it's not used. I would say this is a relevant issue for most organizations' network security because of the risk it represents of being able to escalate from compromising a less privileged machine (e.g. a user's device) to a more privileged machine. It's not a 'oh god every server is going to be pwned' issue, but it doesn't need to be to be worth alerting people to.

> No, I don't think network booting is even all that common outside of extremely niche scenarios.

It's incredibly common though? I've run across it and I work on games and client software, not server stuff.

It's always fearmongering when it comes to "vulnerabilities" that affect the model of locking down computing devices.

This shit used to confuse me so hard when I was learning security. It seemed that articles were talking about something really important, but I just couldn't connect it to anything I knew. Then I realized they weren't talking about security for users, but rather security from users - and for entities ultimately looking to restrict users (the same inversion-of-authority as TSA propaganda). Hence the syndrome of acronym hell, as that amount of overabstraction is required to motivate a system for its own purposes.

Now given that this is a network exploit, you've got to adapt my model a bit from above - my framing is most clear when talking about local "exploits" in locked down bootloaders etc. But from an individual security perspective here? If you've disabled the network stack in your BIOS (because why the hell is it there in the first place), OR put any management interfaces on their own network unreachable from anything that isn't trusted to be managing, this is an utter nothingburger.

> Another breathless fearmongering.

It's Ars; you come to expect it.