Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1103
_____________________________________________________________________

DATE                : 29/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running NetworkPkg (EDK2).

====================================================================
https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
_____________________________________________________________________
 

Pre-boot RCE in EDK II PXE driver
Critical
jkmathews published GHSA-99cj-7hg9-mp4m Oct 22, 2026

Package
NetworkPkg (EDK2)

Affected versions
EDK II master as of 2026-09-14

Patched versions
Not patched currently


Description

Summary

While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated
network attacker who can deliver ICMP error messages to it can corrupt
DXE-phase memory and execute arbitrary code before the operating system
loads, before Secure Boot or measured boot has verified or measured
any OS component.


Details

During network boot, the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe)
keeps a receive request open for ICMP error messages and copies each
received message into the fixed 504-byte field Mode.IcmpError of its
private context structure. The copy loop's bounds handling is incorrect
in both the IPv4 and IPv6 handlers (PxeBcIcmpErrorDpcHandle and
PxeBcIcmp6ErrorDpcHandle): for a message longer than 504 bytes it still
copies bytes into the field, and it advances the destination pointer by
the cumulative rather than the per-fragment length, so an oversized
message writes attacker-controlled bytes past the field. Nothing earlier
on the receive path restricts the message length.


Impact

Unauthenticated, pre-boot, over the network, while a machine is PXE-booting
over IPv4 or IPv6. The attacker needs only to deliver a unicast ICMP error
message addressed to the client's IP, from any network distance; the exposure
window is the duration of the PXE boot.

(a) Deterministic corruption of the driver's private data and a CPU
exception inside the DXE core on the next ICMP error, the boot hangs 
denial of OS provisioning / recovery).

(b) An attacker who knows the target firmware build can plant a counterfeit
event in the same packet and have CoreSignalEvent() dispatch attacker-supplied
bytes in the DXE phase (ring 0, before any OS security control exists).


Patch

#13302


Credit

Thanks to Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google) for finding
this issue and providing the recommended fix.


Severity
Critical
9.5/ 10

CVSS v4 base metrics
Exploitability Metrics
Attack Vector Network
Attack Complexity Low
Attack Requirements Present
Privileges Required None
User interaction None
Vulnerable System Impact Metrics
Confidentiality High
Integrity High
Availability High
Subsequent System Impact Metrics
Confidentiality High
Integrity High
Availability High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVE ID
CVE-2026-97631

Weaknesses
Weakness CWE-120
Weakness CWE-131
Weakness CWE-787

Credits

    @dholmesm dholmesm Finder
    @alexm-anthropic alexm-anthropic Finder



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================