The SEI's CERT Division has released a new vulnerability note: Multiple deserialization vulnerabilities in PyTorch Lightning 2.4.0 and earlier versions. Learn more ➡️
https://t.co/xryQcnUELt
Here is another #UEFI vulnerability that takes months to coordinate. UEFI blocking DBX updates are still trickling in - most Linux and Windows users, trusting SecureBoot, are currently vulnerable. Digitally signing supply-chain is another major gap in our UEFI 5 recommendations
#ESETresearch discovered and reported to @certcc a vulnerability that allows bypassing UEFI Secure Boot on most UEFI-based systems. This vulnerability, #CVE-2024-7344, was found in a UEFI app signed by Microsoft’s 3rd-party UEFI certificate. @smolar_m https://t.co/9P3HZ8JvgC 1/4
In the upcoming #UEFIForum webinar “Coordinating #UEFI Vulnerabilities as CERT/CC,” @CarnegieMellon will provide practical steps when coordinating UEFI vulnerabilities. Join us for the webinar on Nov. 21 at 8 a.m. PT: https://t.co/CFbzuWwkcw
@evilsocket This is so broken disclosure. I don't think @evilsocket knows anything about responsible disclosure. https://t.co/wpbRQol9wk https://t.co/KidxQD3ee1
Trying to find #pkfail in our servers -found one!
vijay@thinkserver-TS$ efi-readvar -v PK
Variable PK, length 862
PK: List 0, type X509
Signature 0, size 834, owner 26dc4851-195f-4ae1-9a19-fbf883bbb35e
Subject:
CN=DO NOT TRUST - AMI Test PK
Issuer:
CN=DO NOT TRUST - AMI Test PK
🚨New! "PKFail: Untrusted Platform Keys Undermine Secure Boot on UEFI Ecosystem."
#PKfail is a supply-chain issue affecting x86/ARM devices around the globe.
Blog:
https://t.co/X3RaVzDWGk
Full report:
https://t.co/BrzDzd5D4L
A free scanning tool: https://t.co/fSqeVlxxT7
"we are repeating the same mistakes that we did in the past, We decided at some point it is super convenient to mix code and data... we are mixing code and data that we send to these AI systems.... that are under the control of the user." Dr. Daniel Gruss https://t.co/J60kKeFBLx
Intel Hardware Shield deep dive: part 2 is SMM security policy reporting (ISSR, aka PPAM) and interaction with Windows' Secure Launch.
https://t.co/tnMMtdtdH1
Another fascinating piece of technology! I have wanted to review this for a while and am glad I have spent time for it.
This iMessage exploit is crazy. TrueType vulnerability that has existed since the 90s, 2 kernel exploits, a browser exploit, and an undocumented hardware feature that was not used in shipped software:
https://t.co/YJdY6alLbV