LogoFAIL: Security Implications of Image Parsing During System Boot
summary
Research shows UEFI image parsers that render vendor boot logos read images from the EFI System Partition or unsigned firmware update sections and are parsed during DXE in C. Using an IDA FiExplorer plugin, emulation harnesses and LibAFL fuzzing, analysts find 21 unique root causes with ~50 crashes judged likely exploitable across hundreds of devices. A proof of concept on a ThinkCentre M70 corrupts AMI’s PNG handling (integer overflow → heap overflow → protocol entry corruption) to achieve arbitrary code execution and disable Secure Boot to load a second‑stage payload.
AI-written summary · about
chapters (13)
- 0:00LogoFAIL introduction
- 1:07What is LogoFAIL
- 3:59Vulnerable UEFI parsers found
- 8:19Locating UEFI parsers
- 11:30Fuzzing UEFI parsers
- 15:29Discovered vulnerabilities
- 19:09PoC exploit development
- 21:41UEFI exploitation challenges
- 24:18Memory corruption techniques
- 29:40Arbitrary code execution
- 32:10LogoFAIL attack demo
- 34:39Findings and impact
- 36:49Q&A
related talks
31mThe Bootloader: An Underestimated Risk To Embedded Linux Security
27mBreaking the Chain of Trust
38mBootloaders Under Fire: Real-World Threats and Practical Defenses
01h 04mAnalyzing UEFI BIOSes from Attacker & Defender Viewpoints
01h 13mIs there an EFI monster inside your apple?
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
57mExtreme Privilege Escalation on Windows 8/UEFI Systems
25mBootStomp: On the Security of Bootloaders in Mobile Devices