BootHole

BootHole 일반 정보 이 저장소는 BootHole 취약점 완화 계획을 관리하는 데 도움이 되는 관련 유용한 스크립트와 추가 도구 또는 정보를 포함하기 위해 만들어졌습니다. Windows 기반 플랫폼 Microsoft가 BootHole DBX 업데이트에서 해지한 서명된 실행 파일이 EFI 시스템 파티션에 있는지 확인하는 Powershell 스크립트를 만들었습니다. Linux 기반 플랫폼 위의 Windows Powershell 스크립트와 유사하게, BootHole DBX 업데이트에서 해지된 서명된 실행 파일이 있는지 확인하는...

efiSeek

适用于 Ghidra 的 efiSeek 简介 该分析器可自动执行 EFI 文件的研究过程，帮助发现和分析已知协议、SMI 处理器等。 功能特性 查找已知的 EFI GUID 识别通过 LOCATEPROTOCOL 函数定位的协议 识别用作 NOTIFY 函数的函数 识别通过 INSTALLPROTOCOLINTERFACE 安装到模块中的协议 识别用作中断函数的函数（如某些硬件、软件/子中断）...

ida-efiutils

用于 IDA Pro 的 EFI 脚本 一些用于辅助逆向工程 EFI 可执行文件的 IDA 脚本。 该包包含以下文件： 1. efiutils.py - 包含一些辅助函数的 IDAPython 模块 2. efiguids.py - 用于 EFI 协议的已知 GUID 集合 3. efiguidsami.py - 用于 AMI BIOS 中使用的协议的已知 GUID 集合 4. behemoth.h - 一个巨大的头文件，包含 EFI 的类型和结构定义集合 5. structs.idc - 包含一些结构定义的 IDC 脚本（已被 behemoth.h 取代） 6...

ghidra-firmware-utils

Ghidra Firmware Utilities Various modules for Ghidra to assist with PC firmware reverse engineering. This was accepted as a coreboot project for GSoC 2019. Features PCI option ROM loader Implements a FS loader for PCI option ROMs handles hybrid ROMs with multiple images, e.g. legacy x86 + UEFI...

CVE-2022-21894-Payload-New

CVE-2022-21894에 대한 간단한 예제 페이로드입니다. 이는 공격자가 두 번째 단계 페이로드를 매핑하여 EFI 서비스를 호출할 수 있는 방법을 보여줍니다. 이 취약점에 대한 분석은 다음에서 확인할 수 있습니다: https://github.com/Wack0/CVE-2022-21894. 이 저장소의 코드는 위에서 언급한 저장소의 PoCpocamd6419041를 확장합니다...

UEFI-Security-Research-Howyar-SysReturn-NetCopy

🌊 UEFIセキュリティリサーチ - Howyar SysReturn NetCopy Secure Bootの外套の下では、それを露呈させた脆弱性よりも深く沈むアーキテクチャもある。失効させられるバイナリもあれば、配信されるパッチもある。しかし水面下深くでは、古い習慣が痕跡を残す。これが、脆弱性が開示され、パッチが当てられ、忘れ去られた後に残るものだ。 🐞 CVE-2026-79298 - 割り当て済み このリポジトリに記録された調査結果には CVE-2026-79298 が割り当てられました。 調整された開示プロセスの中で、ベンダーは CVE-2024-7344 に関連する修正が x...

HvLoader

HvLoader 概要 HvLoader.efi は、外部のハイパーバイザローダーをロードするための EFI アプリケーションです。 HvLoader.efi は指定されたハイパーバイザローダーバイナリ DLL, EFI など をロードし、HvLoader.efi の ImageHandle を渡してそのエントリポイントを呼び出します。これにより、ハイパーバイザローダーバイナリは HvLoader.efi のコマンドラインオプションにアクセスし、それらを設定パラメータとして使用できます。最初の HvLoader.efi コマンドラインオプションは、ハイパーバイザローダーバイナリへのパスで...

CVE-2017-2751

CVE-2017-2751 소비자용 HP 노트북의 BIOS/EFI 비밀번호 추출에 대한 .tex 및 .pdf 파일을 찾을 수 있습니다...

BlackLotus-Detection

CVE-2022-21894 CVE-2022-21894에 관한 모든 것을 위한 공개 저장소 메인 페이지 https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ Windows Defender는 이제 "Possible vulnerable EFI bootloader " 위협을 제거할 수 있습니다. 기본 탐지 지정된 드라이브에 EFI 시스템 파티션...

Rocky Linux 9.2 [CIQ] Security Update: grub2-common / grub2-debuginfo / grub2-efi-aa64 / etc Multiple Vulnerabilities (ciqsa-2026_0426)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260426 advisory. This advisory aggregates security fixes for the grub2 SRPM in CIQ LTS 9.2. It addresses 13 CVEs: CVE-2024-45781, CVE-2025-0622, CVE-2024-45783,...

Rocky Linux 8.6 [CIQ] Security Update: grub2-common / grub2-debuginfo / grub2-efi-aa64 / etc Multiple Vulnerabilities (ciqsa-2026_0881)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260881 advisory. This advisory aggregates security fixes for the grub2 SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2022-2601, CVE-2022-3775. Tenable has extracted the...

Rocky Linux 8 [CIQ] Security Update: grub2-common / grub2-debuginfo / grub2-efi-ia32 / etc Multiple Vulnerabilities (ciqsa-2026_1266)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261266 advisory. This advisory aggregates security fixes for the grub2 SRPM in CIQ FIPS 8. It addresses 3 CVEs: CVE-2024-1048, CVE-2023-4693, CVE-2023-4692. Tenable has...

CentOS Linux 7.9 [CIQ] Security Update: grub2 / grub2-common / grub2-debuginfo / grub2-efi-ia32 / etc Multiple Vulnerabilities (ciqsa-2026_0668)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260668 advisory. This advisory aggregates security fixes for the grub2 SRPM in CIQ CentOS Bridge 7.9. It addresses 2 CVEs: CVE-2021-3695, CVE-2021-3697. Tenable has...

Rocky Linux 8.6 [CIQ] Security Update: grub2-common / grub2-debuginfo / grub2-efi-aa64 / etc Multiple Vulnerabilities (ciqsa-2026_1267)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261267 advisory. This advisory aggregates security fixes for the grub2 SRPM in CIQ LTS 8.6. It addresses 3 CVEs: CVE-2024-1048, CVE-2023-4693, CVE-2023-4692. Tenable has...

AlmaLinux 9.6 [TuxCare] Security Update: grub2-common / grub2-efi-aa64-modules / grub2-efi-x64 / etc (ALMALINUX9.6:CLSA-2026:1771504803)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771504803 advisory. - A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782382498)

"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782382498 advisory. - In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T2...

CentOS Linux 8.4 [TuxCare] Security Update: grub2-common / grub2-efi-ia32 / grub2-efi-ia32-cdboot / etc (CENTOS8.4:CLSA-2026:1771954436)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1771954436 advisory. - A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782382498)

"The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782382498 advisory. - In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T...

CentOS Linux 8 [TuxCare] Security Update: grub2-common / grub2-efi-ia32 / grub2-efi-ia32-cdboot / etc (CENTOS-STREAM8:CLSA-2026:1772112789)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1772112789 advisory. - A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext...

CVE-2022-21894-Payload

これはCVE-2022-21894のシンプルなペイロード例であり、攻撃者がEFIサービスを呼び出せるようにするために第二段階ペイロードをマッピングする方法を示しています。 この脆弱性の解説はこちらでご覧いただけます: https://github.com/Wack0/CVE-2022-21894. このリポジトリのコードは、上記リポジトリのPoC（pocamd6419041）を拡張したものです。...