NetSPI Finds UEFI PNG Decoder Buffer Over-Read via Spoofed IDAT Length
Summary
NetSPI used Qiling to emulate a UEFI PNG decoder and observed an out-of-bounds read when a PNG’s IDAT length was spoofed. The flaw could expose boot-time memory, but actual sensitive-data leakage was not demonstrated.
Key points
- The investigated BIOS/UEFI PNG decoder checked allocation size but did not adequately validate the PNG IDAT length during reads.
- NetSPI emulated the decoder with Qiling, using custom memory mapping, UEFI service hooks, and execution tracing.
- A PNG with a spoofed IDAT length caused the decoder to read beyond the legitimate input buffer and fault on an unmapped address.
- The article describes possible exposure of boot-time RAM or NVRAM contents, but does not demonstrate recovery of sensitive data.
- The firmware module was sanitized, with instructions not exercised in the demonstration replaced by NOPs.
Article Details
- Attack Vectors
- A PNG with a spoofed IDAT chunk length larger than the actual image data can cause the UEFI PNG decoder to read past the input buffer; the reported flaw remains reachable despite an allocation-size check capped at 0x7fffffff.
- The issue was demonstrated in Qiling emulation when the decoder processed the poisoned image. The article describes possible memory or NVRAM disclosure, but does not report a confirmed real-world leak.
- Defensive Notes
- Validate each IDAT read against the actual input-buffer boundary; the allocation-size ceiling alone did not prevent the reported over-read.
- Test firmware image decoders with malformed PNG inputs in an emulated environment and monitor for out-of-bounds reads.
Tools
Capstoneprofessional_trace: This debugging powerhouse utilizes the Capstone engine to provide a real-time disassembly of executed instructions.GhidraWe began inspecting this binary using Ghidra, a reverse engineering tool, to determine whether it was protected against the LogoFail vulnerability.QilingBy emulating the module with Qiling, they showed the flaw can force reads past the image buffer during boot and potentially leak sensitive data from memory or NVRAM.vbindiffWe can manually verify the modification using a hex editor like vbindiff.