Uncovering EDK2 Firmware Flaws: Insights from Code Audit Tools

Autor:	Farahani, Mahsa, Shenavar, Ghazal, Hosseinghorban, Ali, Ejlali, Alireza
Rok vydání:	2024
Předmět:	Computer Science - Cryptography and Security Computer Science - Hardware Architecture Computer Science - Software Engineering
Druh dokumentu:	Working Paper
Popis:	Firmware serves as a foundational software layer in modern computers, initiating as the first code executed on platform hardware, similar in function to a minimal operating system. Defined as a software interface between an operating system and platform firmware, the Unified Extensible Firmware Interface (UEFI) standardizes system initialization and management. A prominent open-source implementation of UEFI, the EFI Development Kit II (EDK2), plays a crucial role in shaping firmware architecture. Despite its widespread adoption, the architecture faces challenges such as limited system resources at early stages and a lack of standard security features. Furthermore, the scarcity of open-source tools specifically designed for firmware analysis emphasizes the need for adaptable, innovative solutions. In this paper, we explore the application of general code audit tools to firmware, with a particular focus on EDK2. Although these tools were not originally designed for firmware analysis, they have proven effective in identifying critical areas for enhancement in firmware security. Our findings, derived from deploying key audit tools on EDK2, categorize these tools based on their methodologies and illustrate their capability to uncover unique firmware attributes, significantly contributing to the understanding and improvement of firmware security. Comment: This paper has been accepted in CPSAT 2024 and will be published in the IEEE Xplore Digital Library
Databáze:	arXiv
Externí odkaz:	http://arxiv.org/abs/2409.14416 Zobrazit plný text záznamu View this record from Arxiv