437
Code-execution flaw in UEFI firmware affects most servers on planet Earth (arstechnica.com)
submitted 2 days ago by to c/technology@lemmy.world
91 comments fedilink hide all child comments
 

๐Ÿ˜ณ

you are viewing a single comment's thread
view the rest of the comments
[โ€“] 18 points 1 day ago (4 children)

That is indeed a hot take. The cve involves crafting a PXE packet, so just.... Don't use PXE in your environment.

If you do, you already know of the dangers of signing exploits in boot images, DNS shenanigans, and all that.

I'm not saying this isn't serious, but it's not really the end of the world.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [โ€“] 8 points 1 day ago (1 child)

    The NSA has made both Microsoft and Apple withhold security patches to make their enemies vulnerable, but also makes the general populace vulnerable to these issues, which can or even has been continuously exploited by hacker groups under nation state actors who considers the US enemy.

    So yes, they should be held liable and sued for not disclosing vulnerabilities to the world at large, because keeping it secret is inherently stupid and self defeatist.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [โ€“] 1 point 1 day ago* (last edited 1 day ago)

    Sure, that may be true. But I am not an international lawyer, so I can't really speak to that point.

    CVEs should be taken with an approach that the cve does matter, but that adding your own exposure to it is the only way to measure its impact on you.

    This is a PXE boot environment vuln, so most of the self-hosting community itself probably doesn't have this enabled at all. A person who does is likely very aware that PXE is already dangerously easy to misconfigure, especially in the days of remote init methods over https, which can at least be layered with other security solutions.

  • permalink
  • fedilink
  • source
  • parent