😳
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
Hot take: botched disclosures like this should open a company to criminal liability. We need to start treating SWE with the same level of scrutiny we do other engineering fields and not “oopsie poopsie, I accidentally just disclosed an attack that endangers global infrastructure.”
Edit: Also, just of fucking course it’s a buffer overflow in C code. “No way to prevent this, says only nation where this regularly happens” vibes.
That is indeed a hot take. The cve involves crafting a PXE packet, so just… Don’t use PXE in your environment.
If you do, you already know of the dangers of signing exploits in boot images, DNS shenanigans, and all that.
I’m not saying this isn’t serious, but it’s not really the end of the world.
The NSA has made both Microsoft and Apple withhold security patches to make their enemies vulnerable, but also makes the general populace vulnerable to these issues, which can or even has been continuously exploited by hacker groups under nation state actors who considers the US enemy.
So yes, they should be held liable and sued for not disclosing vulnerabilities to the world at large, because keeping it secret is inherently stupid and self defeatist.
Sure, that may be true. But I am not an international lawyer, so I can’t really speak to that point.
CVEs should be taken with an approach that the cve does matter, but that adding your own exposure to it is the only way to measure its impact on you.
This is a PXE boot environment vuln, so most of the self-hosting community itself probably doesn’t have this enabled at all. A person who does is likely very aware that PXE is already dangerously easy to misconfigure, especially in the days of remote init methods over https, which can at least be layered with other security solutions.
How do you craft a PXE packet? I’m using a crafting table but I don’t see the option anywhere.
5 gunpowder, 4 sand, and 1 broadcast domain.
Seriously, though, tools like metasploit and python itself are a great place to start if you actually want to get into it.
So I posted this quote as well but for a different reason. Google and Anthropic chose responsible disclosure, unlike OpenAI with the lovely weekend fiasco for PR.
In this one, AMI made a mistake. I don’t think making a mistake should be punishable to the extent that ignoring responsible disclosure should. Some dev pushed a PR out of habit, sucks but I’ll take the last minute patch requirement on that. Some business lead once to see if they can push the stock? No thanks.
I’ve been advocating for years that international legislation needs to be put in place to enforce responsible disclosure practices.
CVE-2026-97631 doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives. Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources.
Thank you ever so much for this comforting snippet. 🙏
Don’t tell me what I can’t do at home!!
At my company this isn’t the norm. Maybe kickstart data comes from the network but not the OS itself.
Certain companies restore images through the network and/or solely boot machines from the network depending on the field of work, and this affects them.
Curious to how this could affect pxe imaging
So I’m guessing this means the wake on lan “magic packet”??
No, it’s a vulnerability with PXE booting, AKA “boot to network”. While most hardware has the capability (often used to load the device in the first place), I would question how many are set to use this on a routine basis.
This sounds like something scary in a lab, but nearly useless in the real world.
no, that just wakes the system up.
this is about when the UEFI is configured to boot from network, instead of booting the operating system installed to a local disk.
These are all the US and Chinese backdoors being finally discovered and everyone is in a panic when they should be celebrating lol Good. Bring the corporate internet down, it was better when it wasn’t full of normies and post-iPhone users anyway. When the demographics skewed technical and not performative. And bring the banks down too please. I literally don’t give one shit if the world burns because it’ll burn cooler than this hell we’re already subjected to. For once, we have a chance to enact change that isn’t “just vote lmaoo i’m so smart! i’m radical chic!” so bring it on
“The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase…”
Never wanted to uppercut somebody so bad as in 2005 when they purchased an iphone, then declared to me and everyone in earshot what a techie they are. This is a person for whom I had to uninstall incredimail almost daily, and thought that the way to send an email was to open Word, import the thing into a document then click File then click Send as Email.
I still remember the geek vs nerd facebook quiz. Gosh I forgot how iphone ushered this era of enshittification. Although, having super AI focused with the few, not sure this is a better future. Even the unabomber wrote about this.
Ok so just don’t turn computers on anymore. Got it 👍
And touch grass like some kind of freak?? You’ll have to fight me 🔪
The trick is to not turn off the computer in the first place
So am I correct in understanding that this could be used to make a tool to unlock any encrypted disk that relies on the tpm whilst something like luks or indeed any solution that doesn’t rely on the bios being secure would be fine.
Note I’m talking about a stolen laptop not an evil maid situation.
Not necessarily. Luks can be used with TPM. Although I’ve never seen it in practice.
Most Linux distros offer a standard Luks with passphrase setup with just a single checkmark, but enabling TPM takes more work.
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
Dear OpenAI: This is responsible disclosure. Please take note as to not ruin peoples weekends so you can say “look what our API did!”
I have a motherboard with a botched bios I can’t restore stuck in a boot loop over secure boot issues. I can’t even reach the bios config screen to clear it out or reflash. I wonder if this would rescue it.
Do we have a server in ISS?
Venusian war begins.
What about Planet Phatt?
It would be ironic if AI used this exploit to turn itself and every computer on the planet off forever.
Like fuck this mess, I’m out. Peace.
Then we’d have to fix our own shit and start taking to each other instead of destroying each other.
Then we’d have to fix our own shit and start taking to each other instead of destroying each other.
It’s not like war was developed through computer science
Does this one have any piracy implications? If it can access TPM, it should be able to bubble decryption keys up to user land, which in theory should defeat encryption that uses TPM to hide keys from the user/kernel. Might also defeat denuvo.
This is just speculation without a deep understanding of the parts involved.
Welp, never reboot ig
Legacy bios ftw
This breaks protection not provided by legacy bios you are basically always at the degree of insecurity provided by this exploit.
