启动大多数服务器的固件中存在一个严重漏洞，可让攻击者在操作系统加载之前运行代码。该漏洞存在于EDK II中，这是大多数固件厂商用来构建UEFI固件的开源代码。负责管理EDK II的TianoCore在10月22日发布的一份公告中给该漏洞评级为9.5分（满分10分）。该漏洞编号为CVE-2026-97631。
A critical flaw in the firmware that starts most servers can let an attacker run code before the operating system loads. It sits in EDK II, the open-source code most firmware makers use to build UEFI firmware. TianoCore, which runs EDK II, rated the bug 9.5 out of 10 in an advisory published on 22 October. The flaw is tracked as CVE-2026-97631.
该漏洞提前数月被公开。Anthropic的亚历克斯·马特罗索夫和谷歌的丹·霍姆斯-米特拉发现了它。据丹·古丁为Ars Technica报道，他们原计划在2027年1月披露该漏洞。今年9月，由固件厂商AMI的一名工程师签字批准的一项公开代码变更以CVE编号描述了该漏洞，并包含了修复方案。
The flaw went public months early. Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google found it. They had planned to disclose it in January 2027, Dan Goodin reported for Ars Technica. In September, a public code change signed off by an engineer at AMI, which makes firmware, described the flaw by its CVE number and included the fix.
“在攻击者拥有短期网络访问权限的情况下，这可用于破解磁盘加密（而在设备被盗的情形下，这会更加容易），”安全公司Dragos的首席研究官HD·摩尔对Ars Technica表示。
“This could be used to break disk encryption for cases where an attacker has short-term network access (and it would be even easier in a theft scenario),” HD Moore, chief research officer at security firm Dragos, told Ars Technica.
攻击如何运作 该漏洞存在于让机器通过网络启动的驱动程序中，这一过程称为PXE。在这种启动过程中，该驱动程序会将传入的ICMP错误消息复制到内存中一个固定的504字节区域。这些是网络设备发回的小型状态消息。公告称，其大小检查有误，因此较长的消息会用攻击者选择的数据覆盖附近的内存。
How the attack works The bug sits in the driver that lets a machine boot over a network, a process known as PXE. During that boot, the driver copies incoming ICMP error messages into a fixed 504-byte area of memory. These are small status messages that network devices send back. Its size checks are wrong, so a longer message overwrites nearby memory with data the attacker chooses, the advisory says.
一条精心构造的消息就能让启动挂起。如果攻击者知道确切的固件版本，还能更进一步，在处理器的最高特权级别上、在Secure Boot进行任何检查之前运行自己的代码。公告称，在机器以这种方式启动时，该消息可以“从任何网络距离”发来。
One crafted message can hang the boot. An attacker who knows the exact firmware build can go further and run their own code at the processor’s most privileged level, before Secure Boot checks anything. The advisory says the message can come “from any network distance” while the machine is booting this way.
接受Ars采访的研究人员对此设定了限制条件。攻击者需要对本地网络拥有一定控制权，这意味着攻击者要么是内部人员，要么是已经站稳脚跟的入侵者。攻击者还必须针对特定模型和配置调整每个漏洞利用程序。据《黑客新闻》报道，红帽和SUSE将该漏洞评为可从相邻网络利用。该漏洞不影响仅从本地磁盘启动的机器。
Researchers who spoke to Ars set limits on that. An attacker needs some control over the local network, which points to insiders or intruders who already have a foothold. Attackers also have to tune each exploit to a specific model and configuration. Red Hat and SUSE rate the flaw as exploitable from an adjacent network, according to The Hacker News. The flaw does not touch machines that boot only from a local disk.
谁受影响 据Ars报道，EDK II是AMI、Insyde和Phoenix固件的基础，也是微软加固版Project Mu的基础。英特尔告诉Ars，它不知道其受支持的商业产品中有任何产品受该漏洞影响，不过设备制造商可能会加入这段代码。Arm表示，该漏洞不直接适用于其产品。AMD、AMI、Phoenix、微软和亚马逊没有回答Ars的问题。
Who is affected EDK II is the base for firmware from AMI, Insyde and Phoenix, and for Project Mu, Microsoft’s hardened version, according to Ars. Intel told Ars it knows of none of its supported commercial products that the flaw affects, though device makers could add the code. Arm said the flaw does not directly apply to its products. AMD, AMI, Phoenix, Microsoft and Amazon did not answer Ars’s questions.
据《黑客新闻》报道，红帽、SUSE和Debian将其EDK II软件包列为受影响且仍未修复。目前没有受到攻击的迹象。截至10月27日，该漏洞未被列入美国网络安全机构CISA维护的已利用漏洞目录。
Red Hat, SUSE and Debian list their EDK II packages as affected and still unfixed, The Hacker News reported. There is no sign of attacks so far. The flaw was not in the catalogue of exploited bugs kept by CISA, the US cybersecurity agency, as of 27 October.
等待补丁 据《黑客新闻》报道，TianoCore于10月15日将修复合并到EDK II源代码中。目前尚无包含该修复的稳定版本发布，公告也未列出已修补的版本。微软的Project Mu于10月26日发布了包含该修复的构建版本。服务器运营者仍需等待其固件制造商发布BIOS或UEFI更新。
Waiting for a patch TianoCore merged a fix into the EDK II source code on 15 October, The Hacker News reported. No stable release includes it yet, and the advisory lists no patched version. Microsoft’s Project Mu released builds with the fix on 26 October. Server operators still have to wait for their firmware maker to ship a BIOS or UEFI update.
该更新应该比过去的固件修复更简单。固件安全公司Eclypsium的首席研究员杰西·迈克尔告诉Ars，该漏洞“可以通过基本的代码修复来解决”，无需撤销安全密钥。在此之前，Ars建议尽可能关闭网络启动，并留意日志中的漏洞利用尝试。
That update should be simpler than past firmware fixes. Jesse Michael, a principal researcher at firmware security firm Eclypsium, told Ars the bug “can be fixed with a basic code fix,” with no need to revoke security keys. Until then, Ars advises turning off network boot where possible and watching logs for exploit attempts.
Ars 称这又是一次拙劣的披露。此前，PHP 于10月21日针对两个提前公开的严重漏洞发布了紧急补丁。攻击者目前正在利用这两个 PHP2Shell 漏洞。微软本周还针对另一个严重漏洞发布了 .NET 紧急修复程序。
Ars called it another botched disclosure, after PHP’s emergency patches on 21 October for two critical flaws that went public early. Attackers are now exploiting both PHP2Shell flaws. Microsoft also shipped emergency .NET fixes for another critical bug this week.