Search

Microsoft Uses Security Copilot to Identify 20 Flaws in Open-Source Bootloaders

Microsoft found the vulnerabilities in the GRUB2, U-Boot, and Barebox bootloaders.

Advertisement
Highlights
  • GRUB2 is the default bootloader for many Linux-based systems
  • U-boot and Barebox bootloaders are typically used in embedded systems
  • Microsoft discovered 11 security flaws in the GRUB2 bootloader
Microsoft Uses Security Copilot to Identify 20 Flaws in Open-Source Bootloaders

Bootloader maintainers have released security updates to fix the issues

Photo Credit: Microsoft

Microsoft Security Copilot, an artificial intelligence (AI) cybersecurity tool, was used to discover several previously unknown vulnerabilities in open-source bootloaders. The Redmond-based tech giant recently revealed a list of the security flaws discovered in three commonly used bootloaders. One of the bootloaders is the default for many Linux-based systems, while the other two are typically used for embedded systems and Internet of Things (IoT) devices. Notably, Microsoft has informed the bootloader maintainers about the exploits, and they have released security updates to fix them.

Microsoft Showcases Its AI System's Vulnerability Discovery Process

In a blog post, Microsoft detailed the discovery process and extent of risk with these vulnerabilities. The company used Security Copilot, an AI-powered security analysis tool that can assist in protecting organisations from threat actors as well as discovering security flaws. These vulnerabilities were detected in GRand Unified Bootloader (GRUB2), U-Boot, and Barebox, commonly used bootloaders for operating systems and devices.

GRUB2 is the default bootloader for many Linux-based systems, whereas U-Boot and Barebox are generally seen in embedded systems and IoT devices. Notably, a bootloader is a small program that runs before the operating system (OS) starts. It is responsible for loading the OS into memory and initiating the boot process.

By using AI, Microsoft Threat Intelligence discovered 11 vulnerabilities in GRUB2, including issues like integer overflows, buffer overflows, and a cryptographic side-channel flaw. These security flaws could allow threat actors to bypass the Unified Extensible Firmware Interface (UEFI) Secure Boot, which is designed to prevent unauthorised code from running during the boot process.

Security Copilot also discovered nine vulnerabilities in U-Boot and Barebox. These were primarily buffer overflows that affected file systems such as SquashFS, EXT4, CramFS, JFFS2, and symlinks. Notably, the threat actor would need to have physical access to the device to exploit these flaws, however, the security risk still exists.

In the case of GRUB2, Microsoft explained that the vulnerabilities could be exploited by attackers to install stealthy bootkits remotely. This is concerning, as such bootkits can persist even after reinstalling the operating system or replacing the hard drive.

The teams behind GRUB2, U-Boot, and Barebox have already released security updates in February to address these vulnerabilities. Users are advised to update their systems to the latest versions to protect themselves from potential cyberattacks.

Affiliate links may be automatically generated - see our ethics statement for details.

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

 
Show Full Article
Please wait...
Advertisement

Related Stories

Popular Mobile Brands
  1. Hubble Unveils Galactic 'Cotton Candy' in the Large Magellanic Cloud
  1. Scientists Discover Heaviest Proton-Emitting Nucleus After Nearly 30 Years
  2. Hubble Unveils Galactic ‘Cotton Candy’ in the Large Magellanic Cloud
  3. James Webb Telescope Maps Fiery Atmosphere of Turbulent Exoplanet WASP-121b
  4. SpaceX Launches 27 Starlink Satellites from California Using Veteran Falcon 9 Booster
  5. Chaurya Paatam, A Crime-Comedy Film with a Twist, Now Streaming on Lionsgate Play
  6. Get Away (2024), A British Comedy-Horror Film, Now Streaming on JioHotstar
  7. Single Now Streaming on Amazon Prime Video: What You Need to Know About Telugu Romantic Comedy
  8. Top Five ChatGPT Prompts to Boost Productivity at Work
  9. Astronomers Discover Most Powerful Cosmic Explosions Since the Big Bang
  10. NASA’s IMAP Spacecraft Gears Up for Mission to Explore Solar System’s Edge
Gadgets 360 is available in
Download Our Apps
App Store App Store
Available in Hindi
App Store
© Copyright Red Pixels Ventures Limited 2025. All rights reserved.
Trending Products »
Latest Tech News »