PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

PixieFail: Nine vulnerabilities in Tianocore's EDK II IPv6 network stack.

blog.quarkslab.com | research | #vulnerability | #ipv6 | #uefi | #edk2 | #pxe | #tianocore
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PixieFail: nine vulnerabilities in the IPv6 network stack of EDK II, TianoCore's open-source UEFI reference implementation, exploitable during network boot (PXE) on many enterprise machines.
Published
Collected

Related coverage

research · blog.quarkslab.com
For Science! - Using an Unimpressive Bug in EDK II to Do Some Fun Exploitation
Turning a limited write primitive in EDK II's Tcg2Smm module into SMM code execution — the flaw only lives before the end of the DXE phase, so it chains into pre-boot privilege escalation.
research · blog.quarkslab.com
Being Overlord on the Steam Deck with 1 Byte
Quarkslab presents two SMM bugs in AMD firmware drivers affecting the Steam Deck and other AMD devices, turning restrictive 1-byte primitives into code execution in System Management Mode.
research · blog.quarkslab.com
Heap Overflow in OpenBSD's slaacd via Router Advertisement
Analysis of a heap overflow in OpenBSD's slaacd: a malformed domain label in a Router Advertisement DNSSL option, patched in March 2022, with a proof-of-concept provided.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · nebusec.ai
Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF
CVE-2023-2156 ("Route of Death") is a Linux kernel vulnerability that was believed to only lead to a DoS attack, and was considered patched in April 2023. However, NebuSec discovered a bypass of the patch and found that it is actually exploitable and can lead to LPE on any Linux distribution that has IPv6 and namespaces enabled. This writeup covers the technical details of the exploit.
research · volexity.com
JS Sniffer: E-commerce Data Theft Made Easy
In late 2017, Volexity began tracking a new e-commerce financial data theft framework named JS Sniffer. The framework gives attackers a quick and efficient way to steal data from compromised […]
Back