Anyone heard of this bulnerability? I'm a boob. Shpuld I be concerned?
reddit / selfhosted

----------------------------------------------------------------------
referefref · 2023-12-07 02:22

I haven't read into the specific vulnerabilities, but if it affects
the image libraries used to display the boot image then potentially
the mitigation is to disable boot logo in the bios.

----------------------------------------------------------------------
No_Dragonfruit_5882 · 2023-12-07 02:23

Yes. We all should be a bit concerned.

"""Because LogoFAIL doesn’t require physical access to the device,
it’s exceptionally powerful"""

But too be honest those exploits only get used after they are
published.

And i wouldnt be much concerned about attacks, but rather WHY THE FUCK
does nobody test those things.

As someone said uefi is a big burning dumpster fire

----------------------------------------------------------------------
No_Dragonfruit_5882 · 2023-12-07 02:24

Read in a blog post that the images get parsed even if you dissable
boot Logo, so i dont think that helps much

----------------------------------------------------------------------
referefref · 2023-12-07 02:36

Well now, that's definitely a problem. Do you have a link to the blog
post?

----------------------------------------------------------------------
No_Dragonfruit_5882 · 2023-12-07 02:47

https://www.reddit.com/r/sysadmin/s/vVKmCkxgcX

Read it in this discussion and its a COMMENT IN THE BLOG ==> Not
confirmed by anyone who wrote the Blog.

Sorry for the missinformation there, thought it was the blog not the
comment section.

Although as everyone said, it cant be confirmed how deep the issue
goes and if its really parsed.

Signing the bios does not help really either because it can be
reflashed from Tools on the PC and the Image is not included in the
signing hash

----------------------------------------------------------------------
neumaticc · 2023-12-07 02:57

\*bulnerability

----------------------------------------------------------------------
referefref · 2023-12-07 05:35

That's brogress

----------------------------------------------------------------------
No_Dragonfruit_5882 · 2023-12-07 06:51

Dont be a boob....
You shpuld be ashamed of yourself xD

----------------------------------------------------------------------
amarao_san · 2023-12-07 15:45

As far as I got, if someone get root on your machine, they can screw
you one more way than you normally expects. So, instead of 100500
known methods how malicious root can screw users, there is an
additional one, so there is, actually, 100501 way to screw user, and
this is fucking big deal, because 100501 is more than 100500!

/s

----------------------------------------------------------------------
neumaticc · 2023-12-07 15:51

its preti bile that reddit doesn't allow you to edit titles

----------------------------------------------------------------------
BCIT_Richard · 2023-12-08 21:22

Yes, from what I read the secondary concern is if the function for the
instructions to parse and the function to display the logo file being
separate functions, disabling the display won't mitigate it.