- Microsoft used backup filot to scan open source bootloaders for vulnerabilities
- It discovered 20 new shortcomings in just short time
- Microsoft says the AI tool saved the company at least one week’s work
Microsoft has revealed more about how its latest AI tools turn out to be useful woundcode vulnerability and more.
The company has published a new blog post describing how it used backup filot (its AI-driven cyber security tool) to find almost two dozen vulnerabilities in different open source bootloaders.
In total, Microsoft found 11 shortcomings in Grub2 and nine more in U-BOOT and Barebox.
Risk of Remote Code -Insiko
GRUB2 (Grand Unified Bootloader version 2) is a bootloader used in Linux and other Unix-like operating systems to control the boot process and load the operating system.
U-BOOT (DAS U-BOOT) and Barebox, on the other hand, are primarily used in embedded systems. U-BOOT is a widely adopted bootloader that supports different architectures, while Barebox is an alternative designed for faster boot times and easier maintenance.
The vulnerabilities range from integers and buffer overflows, to side channel attacks and outside the boundaries read vulnerabilities.
Some of the deficiencies could be used to perform arbitrary code, Microsoft said, while others would need physical access to the vulnerable device, or need the device to be infected with malware in advance.
“While threat actors would probably require access to physical device to utilize U-boot or barebox vulnerability, in the event of grub2, the vulnerabilities could be further exploited to bypass the safe boot and install stealthy bootkits or potentially circumvent other security mechanisms, such as Bitlocker,” Microsoft said.
“The consequences of installing such bootkits are significant as this can give threat actors full control over the device so they can control the boot process and the operating system, compromise on additional units on the network and pursue other malicious activities.”
“Furthermore, it can result in persistent malware that remains intact, even after an operating system reinstalling or a hard disk replacement.”
All the shortcomings have now a cve awarded, and their severity is mostly “medium”, one of which is judged “high” – 7.8/10.
