PongoOS

pongoOS A pre-boot execution environment for Apple boards built on top of checkra1n. Building on macOS Install Xcode + command-line utilities Run make all Building on Linux Install clang if in doubt, from apt.llvm.org Install ld64 and cctools' strip. On Debian/Ubuntu these can be installed from t...

UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

Overview The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. When the UEFI Shell is included in SPI flash, an attacker with the ability to...

PT-2023-24730 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O versions 5.0 through 5.5 Description: An issue was discovered in SystemFirmwareManagementRuntimeDxe. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses...

CVE-2022-40080

Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in the FpGui module, a second call to GetVariable services allows local attackers to execute arbitrary code in the UEFI DXE phase and gain escalated privileges...

Dell PowerEdge Buffer Overflow Vulnerability

Dell PowerEdge Server BIOS is a system update driver from Dell, a security vulnerability in Dell PowerEdge that could be exploited by attackers to cause a denial of service, execute arbitrary code, or compromise information in a UEFI or BIOS pre-boot environment...

Dell PowerEdge 缓冲区错误漏洞

Dell PowerEdge Server BIOS is a system update driver from Dell Dell. A security vulnerability exists in Dell PowerEdge, which can be exploited by an attacker to cause a denial of service, arbitrary code execution, or information disclosure in a UEFI or BIOS pre-boot environment...

rVMI: Perform Full System Analysis with Ease

Manual dynamic analysis is an important concept. It enables us to observe the behavior of a sophisticated malware sample or exploit by executing it in a controlled environment. The information gathered through this process is often crucial in gaining a full understanding of a sample. When...

rVMI: Perform Full System Analysis with Ease

Manual dynamic analysis is an important concept. It enables us to observe the behavior of a sophisticated malware sample or exploit by executing it in a controlled environment. The information gathered through this process is often crucial in gaining a full understanding of a sample. When...

IBM Unified Extensible Firmware Interface Denial of Service Vulnerability

The IBM Unified Extensible Firmware Interface is a standard detailing type interfaces for operating systems to automatically load from a pre-booted operating environment, to an operating system that simplifies the boot process and saves time. A security vulnerability exists in IBM Unified...