本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw

全球各地的防御者正面临着应对又一个拙劣的代码执行漏洞的负担，这一次出现在全球大多数服务器供应商和数据中心使用的启动固件中。

The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence. Last year, a representative of the UEFI Forum called EDK2 the “preeminent solution / implementation of the UEFI specifications.” Virtually all UEFI suppliers (sometimes still called IBVs or independent BIOS vendors), including AMI, Insyde, and Phoenix, use the reference code extensively. Project Mu, Microsoft’s hardened EDK2 fork, used the code containing the vulnerable component as well.

该漏洞的严重性评分为 9.5 分（满分 10 分），存在于 TianoCore EDK II 中。这是一个开源代码库，硬件制造商和云服务提供商使用它来创建在启动序列期间运行的 UEFI 固件。去年，UEFI 论坛的一位代表称 EDK2 是“UEFI 规范的卓越解决方案/实现”。几乎所有的 UEFI 供应商（有时仍被称为 IBV 或独立 BIOS 供应商），包括 AMI、Insyde 和 Phoenix，都在广泛使用该参考代码。微软的强化版 EDK2 分支 Project Mu 也使用了包含该易受攻击组件的代码。

The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses like Secure Boot, which establishes a chain of trust for all code, including the Trusted Platform Module (TPM), loaded during boot. While final payloads delivered by CVE-2026-97631 have no persistence—meaning they run only once—they can give attackers a wide opening to install other payloads that also run each time early in the boot process.

该漏洞被追踪为 CVE-2026-97631，是 ICMP 组件中的一个内存损坏缺陷。攻击者可以利用该缺陷执行恶意代码，这些代码会在操作系统和固件实施防御措施（如安全启动）之前运行。安全启动为启动期间加载的所有代码（包括可信平台模块 TPM）建立了信任链。虽然 CVE-2026-97631 交付的最终有效载荷没有持久性（意味着它们只运行一次），但它们可以为攻击者提供一个广阔的切入点，以安装在每次启动初期都会运行的其他有效载荷。

The Cat Has Left the Bag The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.

秘密泄露 CVE-2026-97631 的发现者——Anthropic 的 Alex Matrosov 和 Google 的 Dan Holmes——原计划将其保密，直到 1 月份进行协调披露。主板及其他硬件制造商 AMI 上个月发布了一个拉取请求（pull request），详细说明了该漏洞并包含了代码修复。一旦该帖子引起发现者的注意，TianoCore 项目成员便在上周发布了公开公告。

With publicly available patch code, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits. Further compounding the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming. Word of the vulnerability comes six days after another botched disclosure, this one involving a critical code-execution vulnerability in the PHP programming language.

随着补丁代码的公开，高级黑客可以轻易地了解该漏洞是如何被触发的，并构建出可用的攻击程序。更紧迫的是，为数千家硬件制造商和云服务提供商销售和使用的数百万台终端设备修补 UEFI 代码漏洞既繁琐又耗时。该漏洞的消息传出时，距离另一次拙劣的披露仅过去六天，那次披露涉及 PHP 编程语言中的一个关键代码执行漏洞。

“This vulnerability in the ICMP parser of the EDK2 network stack is interesting in terms of how it affects the chain of trust and the broader ecosystem,” said HD Moore, creator of Metasploit and chief research officer at security firm Dragos. “An attacker intent on compromising a nearby endpoint or server could use this bug to hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint’s TPM. This could be used to break disk encryption for cases where an attacker has short-term network access (and it would be even easier in a theft scenario).”

Metasploit 的创建者、安全公司 Dragos 的首席研究官 HD Moore 表示：“EDK2 网络栈 ICMP 解析器中的这个漏洞，在它如何影响信任链和更广泛的生态系统方面非常引人注目。意图破坏附近端点或服务器的攻击者可以利用这个漏洞，在启动过程仍能访问敏感组件（如端点的 TPM）时劫持程序流。在攻击者拥有短期网络访问权限的情况下，这可被用于破解磁盘加密（在设备被盗的情况下会更容易）。”

CVE-2026-97631 is a 16-year-old buffer overflow in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe), which is responsible for allowing servers, storage equipment, and other devices to boot using code downloaded from a local network. During this process—known as the pre-execution environment boot—the driver uses a network listener to monitor for ICMP errors. Because the driver doesn’t enforce a memory copy limit of 504 bytes, overwriting adjacent data, a malicious insider or a hacker who has gained low-level access to a local network can send an error message that appends code past this limit. The IUEFI module running on the CPU then becomes corrupted.

CVE-2026-97631 是 PXE 基础代码驱动程序（NetworkPkg/UefiPxeBcDxe）中一个存在了 16 年的缓冲区溢出漏洞，该驱动程序负责允许服务器、存储设备和其他设备使用从本地网络下载的代码进行启动。在此过程中（称为预执行环境启动），驱动程序使用网络监听器来监控 ICMP 错误。由于驱动程序没有强制执行 504 字节的内存复制限制，导致相邻数据被覆盖，恶意内部人员或已获得本地网络底层访问权限的黑客可以发送一条错误消息，将代码附加到该限制之外。随后，在 CPU 上运行的 UEFI 模块就会损坏。

As the official advisory puts it: During network boot, the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) keeps a receive request open for ICMP error messages and copies each received message into the fixed 504-byte field Mode.IcmpError of its private context structure. The copy loop’s bounds handling is incorrect in both the IPv4 and IPv6 handlers (PxeBcIcmpErrorDpcHandle and PxeBcIcmp6ErrorDpcHandle): for a message longer than 504 bytes it still copies bytes into the field, and it advances the destination pointer by the cumulative rather than the per-fragment length, so an oversized message writes attacker-controlled bytes past the field. Nothing earlier on the receive path restricts the message length.

正如官方公告所述： 在网络启动期间，PXE 基础代码驱动程序（NetworkPkg/UefiPxeBcDxe）会保持一个针对 ICMP 错误消息的接收请求，并将每条接收到的消息复制到其私有上下文结构中固定的 504 字节字段 Mode.IcmpError 中。复制循环的边界处理在 IPv4 和 IPv6 处理程序（PxeBcIcmpErrorDpcHandle 和 PxeBcIcmp6ErrorDpcHandle）中均不正确：对于超过 504 字节的消息，它仍然会将字节复制到该字段中，并且它通过累积长度而不是分片长度来推进目标指针，因此超大的消息会将攻击者控制的字节写入该字段之外。接收路径上的任何早期环节都没有限制消息长度。

The malicious error can be delivered through a simple unicast sent from any network distance to a target device’s IP address, as long as it’s sent during the PXE boot sequence. An attacker can deliver a denial-of-service by causing the boot sequence to hang. When the attacker knows what the target firmware build is, it can plant a “counterfeit event” that executes the malicious code on the CPU in its UEFI firmware environment. The code runs in ring 0, a CPU’s most privileged execution level. Because exploits bypass attestation processes designed to cryptographically prove to remote servers that the hardware is secure, they present a key opportunity for elevating limited privileges.

只要在 PXE 启动序列期间发送，这种恶意错误可以通过从任何网络距离发送到目标设备 IP 地址的简单单播来传递。攻击者可以通过导致启动序列挂起来实现拒绝服务攻击。当攻击者知道目标固件版本时，可以植入一个“伪造事件”，在 CPU 的 UEFI 固件环境中执行恶意代码。该代码在 Ring 0（CPU 最高特权执行级别）中运行。由于攻击绕过了旨在向远程服务器加密证明硬件安全的认证过程，它们为提升有限权限提供了关键机会。

Yet Another Forever Day CVE-2026-97631 joins a long list of previously discovered vulnerabilities in UEFI or code that works closely with it. The most severe of them, LogoFail, stemmed from logo images included in the UEFI of just about every hardware maker. Rendering bugs allowed attackers to subvert the chain of trust UEFI enforces and go on to install malicious components before the OS loaded or Secure Boot ran. PixieFail was a vulnerability similar to CVE-2026-97631. It, too, was the result of faulty PXE boot flaws in EDK2. Following discovery of the vulnerability, researchers embarked on multiple fuzzing projects designed to surface other critical flaws in the open source code library. It appears those efforts failed to find this latest flaw.

又一个“永恒之日”漏洞 CVE-2026-97631 加入了 UEFI 或与其紧密协作的代码中先前发现的漏洞长名单。其中最严重的是 LogoFail，它源于几乎每家硬件制造商的 UEFI 中包含的徽标图像。渲染错误允许攻击者破坏 UEFI 强制执行的信任链，并在操作系统加载或安全启动运行之前安装恶意组件。PixieFail 是一个类似于 CVE-2026-97631 的漏洞。它同样是 EDK2 中错误的 PXE 启动缺陷的结果。在该漏洞被发现后，研究人员启动了多个模糊测试项目，旨在挖掘开源代码库中的其他关键缺陷。看来这些努力未能发现这个最新的漏洞。

Other recently discovered UEFI flaws include: PKFail, a supply-chain failure resulting from non-production test platform keys, public for more than a deca

最近发现的其他 UEFI 缺陷包括： PKFail，这是一种由非生产测试平台密钥导致的供应链故障，已公开超过十年。