Metis fuzzing discovers 137 bugs in UEFI edk2 bootloader protocols
Original title: Towards Effective Fuzzing of EDK2 Components
Metis rehosts edk2 protocols as user-space applications and achieves 73.1 percent coverage, 1.7 times higher than FuzzUEr, reporting 26 previously unknown bugs to vendors.
Securing UEFI-based edk2 bootloader is critical for the trusted computing base. Existing fuzzing approaches lack scalability for boot-time interfaces. Metis uses direct-dependency component rehosting to mock dependencies and enable controlled input injection across all channels. Hybrid static analysis and LLM-guided synthesis generate fuzzing harnesses. Evaluation on 60 drivers covering 162 protocols yields 73.1 percent coverage and 137 unknown bugs, of which 26 have been reported including 12 remotely triggerable. All reported issues have been acknowledged by vendors.
- 73.1 percent coverage, 1.7 times higher than FuzzUEr
- 137 previously unknown bugs discovered
- 26 reported including 12 remotely triggerable
- All bugs acknowledged by vendors
- Focus on protocol interfaces and dependency interactions
Impact: high-severity vulnerabilities in UEFI bootloader
- 1.Upgrade to fixed edk2 version
- 2.Apply vendor patches
- 3.Test bootloader interfaces
From the original article
1 min read at arxiv.orgSecuring bootloaders is critical to establishing the trusted computing base of modern systems. TianoCore's edk2, the de facto UEFI-based bootloader, is widely deployed but has recently been shown to contain numerous high-severity vulnerabilities. Existing approaches either focus on post-boot interfaces or rely on heavyweight simulation, limiting their scalability, throughput, and coverage of boot-time components.
By Datta Manikanta Sri Hari Danduri · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.