😳
I have a motherboard with a botched bios I can’t restore stuck in a boot loop over secure boot issues. I can’t even reach the bios config screen to clear it out or reflash. I wonder if this would rescue it.
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
Dear OpenAI: This is responsible disclosure. Please take note as to not ruin peoples weekends so you can say “look what our API did!”
CVE-2026-97631 doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives. Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources.
Thank you ever so much for this comforting snippet. 🙏
Don’t tell me what I can’t do at home!!
At my company this isn’t the norm. Maybe kickstart data comes from the network but not the OS itself.
Certain companies restore images through the network and/or solely boot machines from the network depending on the field of work, and this affects them.
These are all the US and Chinese backdoors being finally discovered and everyone is in a panic when they should be celebrating lol Good. Bring the corporate internet down, it was better when it wasn’t full of normies and post-iPhone users anyway. When the demographics skewed technical and not performative. And bring the banks down too please. I literally don’t give one shit if the world burns because it’ll burn cooler than this hell we’re already subjected to. For once, we have a chance to enact change that isn’t “just vote lmaoo i’m so smart! i’m radical chic!” so bring it on
“The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase…”
Never wanted to uppercut somebody so bad as in 2005 when they purchased an iphone, then declared to me and everyone in earshot what a techie they are. This is a person for whom I had to uninstall incredimail almost daily, and thought that the way to send an email was to open Word, import the thing into a document then click File then click Send as Email.
I still remember the geek vs nerd facebook quiz. Gosh I forgot how iphone ushered this era of enshittification. Although, having super AI focused with the few, not sure this is a better future. Even the unabomber wrote about this.
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
Hot take: botched disclosures like this should open a company to criminal liability. We need to start treating SWE with the same level of scrutiny we do other engineering fields and not “oopsie poopsie, I accidentally just disclosed an attack that endangers global infrastructure.”
Edit: Also, just of fucking course it’s a buffer overflow in C code. “No way to prevent this, says only nation where this regularly happens” vibes.
So I posted this quote as well but for a different reason. Google and Anthropic chose responsible disclosure, unlike OpenAI with the lovely weekend fiasco for PR.
In this one, AMI made a mistake. I don’t think making a mistake should be punishable to the extent that ignoring responsible disclosure should. Some dev pushed a PR out of habit, sucks but I’ll take the last minute patch requirement on that. Some business lead once to see if they can push the stock? No thanks.
I’ve been advocating for years that international legislation needs to be put in place to enforce responsible disclosure practices.
That is indeed a hot take. The cve involves crafting a PXE packet, so just… Don’t use PXE in your environment.
If you do, you already know of the dangers of signing exploits in boot images, DNS shenanigans, and all that.
I’m not saying this isn’t serious, but it’s not really the end of the world.
How do you craft a PXE packet? I’m using a crafting table but I don’t see the option anywhere.
5 gunpowder, 4 sand, and 1 broadcast domain.
Seriously, though, tools like metasploit and python itself are a great place to start if you actually want to get into it.
Does this one have any piracy implications? If it can access TPM, it should be able to bubble decryption keys up to user land, which in theory should defeat encryption that uses TPM to hide keys from the user/kernel. Might also defeat denuvo.
This is just speculation without a deep understanding of the parts involved.
So am I correct in understanding that this could be used to make a tool to unlock any encrypted disk that relies on the tpm whilst something like luks or indeed any solution that doesn’t rely on the bios being secure would be fine.
Note I’m talking about a stolen laptop not an evil maid situation.
Not necessarily. Luks can be used with TPM. Although I’ve never seen it in practice.
Most Linux distros offer a standard Luks with passphrase setup with just a single checkmark, but enabling TPM takes more work.
Ok so just don’t turn computers on anymore. Got it 👍
And touch grass like some kind of freak?? You’ll have to fight me 🔪
Do we have a server in ISS?
Legacy bios ftw
This breaks protection not provided by legacy bios you are basically always at the degree of insecurity provided by this exploit.
What about Planet Phatt?
It would be ironic if AI used this exploit to turn itself and every computer on the planet off forever.
Like fuck this mess, I’m out. Peace.
Then we’d have to fix our own shit and start taking to each other instead of destroying each other.
Then we’d have to fix our own shit and start taking to each other instead of destroying each other.
It’s not like war was developed through computer science
Venusian war begins.
