BootHole

BootHole General information This repository was created to contain relevant helpful scripts and any additional tools or information that can assist others in managing their BootHole vulnerability mitigation plans. Windows Based Platforms We have created a Powershell script that will check the EF...

ghidra-firmware-utils

Ghidra Firmware Utilities Various modules for Ghidra to assist with PC firmware reverse engineering. This was accepted as a coreboot project for GSoC 2019. Features PCI option ROM loader Implements a FS loader for PCI option ROMs handles hybrid ROMs with multiple images, e.g. legacy x86 + UEFI...

CVE-2022-21894-Payload-New

This is a simple example payload for CVE-2022-21894 that demonstrates how an attacker could map a second stage payload in order to be able to call EFI services. A writeup of this vulnerability can be viewed here: https://github.com/Wack0/CVE-2022-21894. The code in this repository extends the PoC...

UEFI-Security-Research-Howyar-SysReturn-NetCopy

🌊 UEFI Security Research - Howyar SysReturn NetCopy Under the cloak of Secure Boot, some architectures sink deeper than the vulnerabilities that exposed them. Some binaries are revoked. Some patches are shipped. But deep below the surface, old habits leave traces. This is what remains when a...

HvLoader

HvLoader Overview HvLoader.efi is an EFI application for loading an external hypervisor loader. HvLoader.efi loads a given hypervisor loader binary DLL, EFI, etc., and calls it's entry point passing HvLoader.efi ImageHandle. This way the hypervisor loader binary has access to HvLoader.efi's comma...

CVE-2017-2751

You'll find the .tex and .pdf file for CVE-2017-2751, a BIOS/EFI password extraction for consumer HP laptops...

BlackLotus-Detection

CVE-2022-21894 Public repo for anything CVE-2022-21894 Main page https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ Windows Defender now capable of removing this threat "Possible vulnerable EFI bootloader " Bas...

Rocky Linux 8.6 [CIQ] Security Update: grub2-common / grub2-debuginfo / grub2-efi-aa64 / etc Multiple Vulnerabilities (ciqsa-2026_0881)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260881 advisory. This advisory aggregates security fixes for the grub2 SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2022-2601, CVE-2022-3775. Tenable has extracted the...

Rocky Linux 9.2 [CIQ] Security Update: grub2-common / grub2-debuginfo / grub2-efi-aa64 / etc Multiple Vulnerabilities (ciqsa-2026_0426)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260426 advisory. This advisory aggregates security fixes for the grub2 SRPM in CIQ LTS 9.2. It addresses 13 CVEs: CVE-2024-45781, CVE-2025-0622, CVE-2024-45783,...

Rocky Linux 8.6 [CIQ] Security Update: grub2-common / grub2-debuginfo / grub2-efi-aa64 / etc Multiple Vulnerabilities (ciqsa-2026_1267)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261267 advisory. This advisory aggregates security fixes for the grub2 SRPM in CIQ LTS 8.6. It addresses 3 CVEs: CVE-2024-1048, CVE-2023-4693, CVE-2023-4692. Tenable has...

AlmaLinux 9.6 [TuxCare] Security Update: grub2-common / grub2-efi-aa64-modules / grub2-efi-x64 / etc (ALMALINUX9.6:CLSA-2026:1771504803)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771504803 advisory. - A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext...

CentOS Linux 7.9 [CIQ] Security Update: grub2 / grub2-common / grub2-debuginfo / grub2-efi-ia32 / etc Multiple Vulnerabilities (ciqsa-2026_0668)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260668 advisory. This advisory aggregates security fixes for the grub2 SRPM in CIQ CentOS Bridge 7.9. It addresses 2 CVEs: CVE-2021-3695, CVE-2021-3697. Tenable has...

Rocky Linux 8 [CIQ] Security Update: grub2-common / grub2-debuginfo / grub2-efi-ia32 / etc Multiple Vulnerabilities (ciqsa-2026_1266)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261266 advisory. This advisory aggregates security fixes for the grub2 SRPM in CIQ FIPS 8. It addresses 3 CVEs: CVE-2024-1048, CVE-2023-4693, CVE-2023-4692. Tenable has...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782382498)

"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782382498 advisory. - In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T2...

CentOS Linux 8.4 [TuxCare] Security Update: grub2-common / grub2-efi-ia32 / grub2-efi-ia32-cdboot / etc (CENTOS8.4:CLSA-2026:1771954436)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1771954436 advisory. - A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext...

CentOS Linux 8 [TuxCare] Security Update: grub2-common / grub2-efi-ia32 / grub2-efi-ia32-cdboot / etc (CENTOS-STREAM8:CLSA-2026:1772112789)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1772112789 advisory. - A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782382498)

"The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782382498 advisory. - In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T...

CVE-2022-21894-Payload

This is a simple example payload for CVE-2022-21894 that demonstrates how an attacker could map a second stage payload in order to be able to call EFI services. A writeup of this vulnerability can be viewed here: https://github.com/Wack0/CVE-2022-21894. The code in this repository extends the PoC...

CVE-2026-25250

🕷️ CVE-2026-25250: Improper Trusted Bootloader Chain Validation A Microsoft-signed third-party bootloader that loads a secondary EFI binary with no signature or integrity verification, collapsing the Secure Boot chain of trust from within. 📑 Table of Contents Research Context Official References...

efiSeek

efiSeek для Ghidra О проекте Анализатор автоматизирует процесс исследования EFI-файлов, помогает обнаруживать и анализировать известные протоколы, smi-обработчики и т.д. Возможности Находит известные GUID EFI Определяет протоколы, расположенные с помощью функции LOCATEPROTOCOL Определяет функции,...