CVE-2023-40547 – avoid incorrectly trusting HTTP headers

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by JohnFen on Thursday January 25, 2024 @02:05PM (#39133538)

> When you tell shim what EFI binary to boot, you can specify it as an HTTP URL.

Thank you for explaining this. I was seriously curious as to why a boot loader would be doing any network communications at all.

[ Parent | on HN ]

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by dharmab on Thursday January 25, 2024 @03:25PM (#39134742)

As a junior IT person long ago we used remote image booting in our lab to quickly test new software builds on real hardware. Back then it involved janky TFTP.

[ Parent | on HN ]

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by fullspectrumdev on Thursday January 25, 2024 @04:21PM (#39135482)

The horrors of PXE? Where you end up with a clusterfuck of DHCP and TFTP to load the correct image?

[ Parent | on HN ]

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by dharmab on Thursday January 25, 2024 @08:47PM (#39138004)

Exactly!

[ Parent | on HN ]