{"id":7474,"date":"2022-02-16T13:05:01","date_gmt":"2022-02-16T13:05:01","guid":{"rendered":"https:\/\/www.hostingseekers.com\/blog\/?p=7474"},"modified":"2025-03-06T10:47:14","modified_gmt":"2025-03-06T10:47:14","slug":"major-vulnerabilities-found-in-top-servers","status":"publish","type":"post","link":"https:\/\/www.hostingseekers.com\/blog\/major-vulnerabilities-found-in-top-servers\/","title":{"rendered":"Security Malfunctions Of High Risk Identified In Top Servers"},"content":{"rendered":"

Binarly discovered not one, but more than 20 vulnerabilities in popular servers. Those were affecting unified extensible firmware interfaces (UEFI) software that allow hackers to easily bypass hardware security mechanisms.<\/span><\/p>\n

Binarly<\/span><\/a>, a well-known security firm has found more than 20,000 vulnerabilities that were hiding in BIOS, UEFI software belonging to a wide range of system vendors, like<\/span> Intel<\/span>, <\/span>Microsoft<\/span>, <\/span>Lenovo<\/span>, <\/span>Dell<\/span>, <\/span>Bull Atos<\/span>, <\/span>Fujitsu<\/span>, <\/span>HPE, <\/span>HP<\/span>, and also <\/span>Siemens<\/span>.<\/span><\/p>\n

Binarly found that all the vulnerabilities were associated with the use of InsydeH20, a framework code that is used to build motherboard unified extensible firmware interfaces (UEFI). This is an interface between a computer\u2019s operating system and firmware.<\/span><\/p>\n

\n

Why Vulnerabilities were of high risk?<\/b><\/h2>\n

All these vulnerabilities are actually so dangerous, because, the UEFI\/BIOS-based attacks can bypass firmware-based security mechanisms. These malfunctions include SMM all-out or privilege escalation, SMM memory corruption, and DXE memory corruption.<\/span><\/p>\n

The damage done by these vulnerabilities is very severe.\u00a0 They can cause by attackers to bypass hardware-based security features like secure boot, virtualization-based security, and also trusted platform modules (TPM).\u00a0<\/span><\/p>\n

Initially, 23 malfunctions were disclosed by Binalry, but later found out five more, that were related to HP hardware. Binarly announced, these vulnerabilities were capable of affecting both desktop and server hardware, and thus have been reported about them to vendors and to Insyde. Fixes are still going on.<\/span><\/p>\n

Binalry has been working closely with <\/span>CERT\/CC <\/span>and <\/span>Insyde<\/span> teams for the last few months to confirm fixes of all vulnerabilities, provide additional technical details, evaluate the associated risks, and worked through the responsible disclosure process.<\/span><\/p>\n

Binalry has now also partnered with <\/span>Linux Vendor Firmware Service<\/span> (LVFS) to find out other vendors and scale their services to identify more affected hardware models that are using firmware vulnerabilities detection tools, known as FwHunt.<\/span><\/p>\n

\n

If you enjoyed reading this news, you are surely going to cherish these too \u2013<\/em><\/h4>\n