efiSeek

efiSeek for Ghidra About The analyzer automates the process of researching EFI files, helps to discover and analyze well-known protocols, smi handlers, etc. Features Finds known EFI GUID's Identifies protocols located with LOCATEPROTOCOL function Identifies functions used as the NOTIFY function...

BootHole

BootHole General information This repository was created to contain relevant helpful scripts and any additional tools or information that can assist others in managing their BootHole vulnerability mitigation plans. Windows Based Platforms We have created a Powershell script that will check the EF...

ghidra-firmware-utils

Ghidra Firmware Utilities Various modules for Ghidra to assist with PC firmware reverse engineering. This was accepted as a coreboot project for GSoC 2019. Features PCI option ROM loader Implements a FS loader for PCI option ROMs handles hybrid ROMs with multiple images, e.g. legacy x86 + UEFI...

CVE-2022-21894-Payload

This is a simple example payload for CVE-2022-21894 that demonstrates how an attacker could map a second stage payload in order to be able to call EFI services. A writeup of this vulnerability can be viewed here: https://github.com/Wack0/CVE-2022-21894. The code in this repository extends the PoC...

BlackLotus-Detection

CVE-2022-21894 Public repo for anything CVE-2022-21894 Main page https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ Windows Defender now capable of removing this threat "Possible vulnerable EFI bootloader " Bas...

Siemens SIMATIC S7-1500 TM MFP Release of Invalid Pointer or Reference (CVE-2026-23352)

In the Linux kernel, the following vulnerability has been resolved: x86/efi: defer freeing of boot services memory efifreebootservices frees memory occupied by EFIBOOTSERVICESCODE and EFIBOOTSERVICESDATA using memblockfreelate. There are two issue with that: memblockfreelate should be used for...

CVE-2026-25250

🕷️ CVE-2026-25250: Improper Trusted Bootloader Chain Validation A Microsoft-signed third-party bootloader that loads a secondary EFI binary with no signature or integrity verification, collapsing the Secure Boot chain of trust from within. 📑 Table of Contents Research Context Official References...

CVE-2022-21894-Payload-New

This is a simple example payload for CVE-2022-21894 that demonstrates how an attacker could map a second stage payload in order to be able to call EFI services. A writeup of this vulnerability can be viewed here: https://github.com/Wack0/CVE-2022-21894. The code in this repository extends the PoC...

SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4706-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4706-1 advisory. The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security...

UEFI-Security-Research-Howyar-SysReturn-NetCopy

🌊 UEFI Security Research - Howyar SysReturn NetCopy Under the cloak of Secure Boot, some architectures sink deeper than the vulnerabilities that exposed them. Some binaries are revoked. Some patches are shipped. But deep below the surface, old habits leave traces. This is what remains when a...

HvLoader

HvLoader Overview HvLoader.efi is an EFI application for loading an external hypervisor loader. HvLoader.efi loads a given hypervisor loader binary DLL, EFI, etc., and calls it's entry point passing HvLoader.efi ImageHandle. This way the hypervisor loader binary has access to HvLoader.efi's comma...

CVE-2017-2751

You'll find the .tex and .pdf file for CVE-2017-2751, a BIOS/EFI password extraction for consumer HP laptops...

Astra Linux – Vulnerability in edk2

In Ubuntu’s EDK2, a insecure default setting was left enabled, allowing UEFI Shell to be used. This enables an attacker with access to the operating system to bypass Secure Boot...

Astra Linux – Vulnerability in Linux 5.15

In the efirtasmwrapper of efi-rt-wrapper.S, there is a possible way to bypass shadow stack protection due to a logical error in the code. This could result in a local escalation of privileges without the need for additional execution privileges. User interaction is not required for exploitation...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: EFI: In runtime mode, a potential overflow of the size of the soft-reserved region has been fixed. If there are pages worth ≥ 4GB in a soft-reserved region, the value of mdsize will be reduced...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: EFI: Do not map the entire mokvar table to determine its size. Currently, when validating the mokvar table, we re-map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: corrected incorrect allocation size gcc-14 notes that the allocation using sizeofvoid on 32-bit architectures is insufficient for a 64-bit physaddrt: drivers/firmware/efi/capsule-loader.c: In the function...

CVE-2026-90212

A flaw was found in the Linux kernel's arm64 EFI Extensible Firmware Interface implementation. When software PAN Privileged Access Never is enabled, the system can experience a bad kernel memory access. This occurs due to incorrect handling of the TTBR0EL1 register during voluntary preemption...

OPENSUSE-SU-2026:22091-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function bsc1253340. - CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock...

SUSE-SU-2026:24184-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function bsc1253340. - CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock...