Hacker News Reader

Is this completely mitigated by disabling boot logos?

Edit: What I mean is, do the image parsers still run if boot logos are disabled?

> Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities

I'd suspect that an image parser is only involved when a logo needs to be displayed. So it looks like a great way to lower the chances of triggering these vulnerabilities. I'll switch off mine.

OTOH if an image parser is also invoked when the logo is updated, to check that it parses correctly, this won't be enough :(

I guess I wouldn't be surprised at all if some BIOSes always parse the logo and the switch just turns off the display.

No because an attacker who got control could undisable them, then become persistently entrenched in your system such that you remain compromised even if you reinstall your OS.

Right. I was more curious about if the image parsing code was still vulnerable while boot logos are disabled.

Oh, you mean disabled in the motherboard's firmware settings. I hadn't consider that interpretation of your question.

ADDED. I disabled it in my ASUS motherboard's settings.

Reply on news.ycombinator.com