• Source: LogoFAIL

LogoFAIL is a security vulnerability and exploit thereof that affects computer motherboard firmware with TianoCore EDK II, including Insyde Software's InsydeH2O modules and similar code in AMI and Phoenix firmware, which are commonly found on both Intel and AMD motherboards, and which enable loading of custom boot logos. The exploit was discovered in December 2023 by researchers at Binarly.




Description


The vulnerability exists when the Driver Execution Environment (DXE) is active after a successful Power On Self Test (POST) in the UEFI firmware (also known as the BIOS). The UEFI's boot logo is replaced with the exploit payload at this point, and the exploit can then take control of the system.




Patches


Intel patched the issue in Intel Management Engine (ME) version 16.1.30.2307 in December 2023. AMD addressed the problem in AGESA version 1.2.0.b, although some motherboard manufacturers did not include the fix under AGESA 1.2.0.c.




External links


CVE-2023-40238
Binarly analysis of LogoFAIL




References

Kata Kunci Pencarian:

• LogoFAIL
• Insyde Software
• TianoCore EDK II
• List of security hacking incidents
• Fur Affinity
• Timeline of computing 2020–present
• AGESA
• Emotet
• JBS S.A. ransomware attack
• Account pre-hijacking