Feed: Slashdot
Feed Link: https://slashdot.org/
---

Title: Microsoft Uses AI To Find Flaws In GRUB2, U-Boot, Barebox Bootloaders

Link: https://news.slashdot.org/story/25/04/05/0250...

Slashdot reader zlives shared this report from BleepingComputer: Microsoft
used its AI-powered Security Copilot to discover 20 previously unknown
vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders.
GRUB2 (GRand Unified Bootloader) is the default boot loader for most Linux
distributions, including Ubuntu, while U-Boot and Barebox are commonly used
in embedded and IoT devices. Microsoft discovered eleven vulnerabilities in
GRUB2, including integer and buffer overflows in filesystem parsers, command
flaws, and a side-channel in cryptographic comparison. Additionally, 9 buffer
overflows in parsing SquashFS, EXT4, CramFS, JFFS2, and symlinks were
discovered in U-Boot and Barebox, which require physical access to exploit.
The newly discovered flaws impact devices relying on UEFI Secure Boot, and if
the right conditions are met, attackers can bypass security protections to
execute arbitrary code on the device. While exploiting these flaws would
likely need local access to devices, previous bootkit attacks like BlackLotus
achieved this through malware infections. Miccrosoft titled its blog post
"Analyzing open-source bootloaders: Finding vulnerabilities faster with AI."
(And they do note that Micxrosoft disclosed the discovered vulnerabilities to
the GRUB2, U-boot, and Barebox maintainers and "worked with the GRUB2
maintainers to contribute fixes... GRUB2 maintainers released security
updates on February 18, 2025, and both the U-boot and Barebox maintainers
released updates on February 19, 2025." They add that performing their
initial research, using Security Copilot "saved our team approximately a
week's worth of time," Microsoft writes, "that would have otherwise been
spent manually reviewing the content." Through a series of prompts, we
identified and refined security issues, ultimately uncovering an exploitable
integer overflow vulnerability. Copilot also assisted in finding similar
patterns in other files, ensuring comprehensive coverage and validation of
our findings... As AI continues to emerge as a key tool in the cybersecurity
community, Microsoft emphasizes the importance of vendors and researchers
maintaining their focus on information sharing. This approach ensures that
AI's advantages in rapid vulnerability discovery, remediation, and
accelerated security operations can effectively counter malicious actors'
attempts to use AI to scale common attack tactics, techniques, and procedures
(TTPs). This week Google also announced Sec-Gemini v1, "a new experimental AI
model focused on advancing cybersecurity AI frontiers."

Read more of this story at Slashdot.

---
VRSS v2.1.180528