TLDR Tech / InfoSec
Emulating & Exploiting UEFI: Unveiling Vulnerabilities in Firmware Security
NetSPI discovered a buffer over-read in a UEFI PngDecoderDxe module during a LogoFail audit: the decoder validates total allocation size against 0x7fffffff but never bounds-checks reads against actual compressed data, so spoofing the PNG IDAT chunk length to 0x90000000 causes the decompressor loop (mov al, byte ptr [r13+rcx] at RIP 0x104106) to read past the input buffer at 0x9000000 into adjacent pre-OS memory containing cryptographic keys and assembly code. NetSPI demonstrated the over-read using a Qiling harness with hooked AllocatePool/FreePool calls and 0x10000000-spaced heap regions to cleanly observe the UC_MEM_READ_UNMAPPED fault, with leaked data theoretically exfiltrable via HDMI/VGA capture of the boot display. Defenders should audit UEFI image parsers for missing read-side bounds checks, independent of allocation-size guards, and apply the Qiling harness technique to fuzz other firmware image-handling modules.
Read the full story