一项严重性评分为9.5分的UEFI固件代码执行漏洞CVE-2026-97631已被披露 1。该缺陷存在于开源代码库TianoCore EDK II的ICMP组件中，被描述为内存损坏漏洞 1。由于AMI、Insyde、Phoenix以及微软的Project Mu等厂商均使用该参考代码，且UEFI Forum称EDK II为“主要解决方案/实现”，该漏洞可能影响全球绝大多数服务器 1。
攻击者可利用此缺陷在操作系统和Secure Boot等防御机制加载前执行恶意代码 1。尽管最终有效载荷不具备持久性（仅运行一次），但攻击者可借此开辟通道以安装其他启动期载荷 1。
Security researchers have disclosed a severe vulnerability in the TianoCore EDK II open-source codebase, which underpins the Unified Extensible Firmware Interface (UEFI) for most servers worldwide 1. The flaw, designated CVE-2026-97631, carries a critical severity rating of 9.5 out of 10 1. This issue resides within an ICMP component and manifests as a memory-corruption defect that allows attackers to execute malicious code during the boot process 1. Because this execution occurs before the operating system loads and prior to the implementation of security mechanisms like Secure Boot, it bypasses standard defensive layers 1.
The impact extends across major hardware vendors because AMI, Insyde, Phoenix, and Microsoft’s Project Mu all utilize the affected reference code from TianoCore EDK II 1. While the initial payload enabled by this vulnerability lacks persistence and runs only once, it serves as a crucial foothold for installing subsequent boot-time payloads 1. The UEFI Forum has described TianoCore EDK II as the "preeminent solution / implementation of the UEFI specifications," highlighting its widespread adoption in server environments globally 1.
评论
还没有评论，欢迎留下第一条。