For Science! - Using an Unimpressive Bug in EDK II To Do Some Fun Exploitation

Display subtitles automatically

None
In the preferred language only when the video is using another
Always in the preferred language
Always in the original language of the video

Preferred language:

Qualities

UbiCast player

Keyboard shortcuts

Key

Action

K or space

Play / Pause

Mute / Unmute

Select next subtitles

Select next audio track

Show slide in full page or toggle automatic source change

left arrow

Seek 5s backward

right arrow

Seek 5s forward

shift + left arrow or J

Seek 10s backward

shift + right arrow or L

Seek 10s forward

control + left arrow

Seek 60s backward

control + right arrow

Seek 60s forward

shift + down arrow

Decrease volume

shift + up arrow

Increase volume

shift + comma

Decrease playback rate

shift + dot or shift + semicolon

Increase playback rate

end

Seek to end

beginning

Seek to beginning

Loading Click here to add:

Subscribe to notifications

When subscribed to notifications, an email will be sent to you for all added annotations.

Your user account has no email address.

Information on this media

Number of views:

Creation date:

July 3, 2023

Speakers:

Gabrielle Viala

License:

CC BY-SA v4

Description

EDK II is the public implementation of UEFI on which a large part of the OEMs rely to craft their own firmware. If a vulnerability were to be found in this project, it could become a huge problem as it could impact many devices. Or... It could be unimpressive and go totally unnoticed because nobody cares. ¯\\\_(ツ)_/¯ In this talk, we'll present a bug in EDK II which is difficult to leverage in real life but still quite fun to attack. We'll see how we can build a complete exploit solely based on the mechanisms that are present in the public implementation and how we can gain arbitrary code execution in SMM thanks to that.

Gabrielle Viala

Gabrielle is a reverse engineer at Quarkslab. Her main domains of interest are the Windows internals and UEFI components.