Microsoft found 20 previously unidentified flaws in the GRUB2, U-Boot, and Barebox open-source bootloaders using its AI-powered Security Copilot.
While U-Boot and Barebox are frequently utilized in embedded and Internet of Things devices, GRUB2 (GRand Unified Bootloader) is the default boot loader for the majority of Linux variants, including Ubuntu.
Microsoft found eleven vulnerabilities in GRUB2, including a side-channel in cryptographic comparison, command errors, and integer and buffer overflows in filesystem parsers.
Furthermore, nine buffer overflows that require physical access to exploit were found in U-Boot and Barebox in the parsing of SquashFS, EXT4, CramFS, JFFS2, and symlinks.
Devices that use UEFI Secure Boot are affected by the recently found vulnerabilities read more about Microsoft uses AI to find flaws in GRUB2 U-Boot Barebox bootloaders.