Search

Microsoft Uses Security Copilot to Identify 20 Flaws in Open-Source Bootloaders

Microsoft found the vulnerabilities in the GRUB2, U-Boot, and Barebox bootloaders.

Advertisement
Highlights
  • GRUB2 is the default bootloader for many Linux-based systems
  • U-boot and Barebox bootloaders are typically used in embedded systems
  • Microsoft discovered 11 security flaws in the GRUB2 bootloader
Microsoft Uses Security Copilot to Identify 20 Flaws in Open-Source Bootloaders

Bootloader maintainers have released security updates to fix the issues

Photo Credit: Microsoft

Microsoft Security Copilot, an artificial intelligence (AI) cybersecurity tool, was used to discover several previously unknown vulnerabilities in open-source bootloaders. The Redmond-based tech giant recently revealed a list of the security flaws discovered in three commonly used bootloaders. One of the bootloaders is the default for many Linux-based systems, while the other two are typically used for embedded systems and Internet of Things (IoT) devices. Notably, Microsoft has informed the bootloader maintainers about the exploits, and they have released security updates to fix them.

Microsoft Showcases Its AI System's Vulnerability Discovery Process

In a blog post, Microsoft detailed the discovery process and extent of risk with these vulnerabilities. The company used Security Copilot, an AI-powered security analysis tool that can assist in protecting organisations from threat actors as well as discovering security flaws. These vulnerabilities were detected in GRand Unified Bootloader (GRUB2), U-Boot, and Barebox, commonly used bootloaders for operating systems and devices.

GRUB2 is the default bootloader for many Linux-based systems, whereas U-Boot and Barebox are generally seen in embedded systems and IoT devices. Notably, a bootloader is a small program that runs before the operating system (OS) starts. It is responsible for loading the OS into memory and initiating the boot process.

By using AI, Microsoft Threat Intelligence discovered 11 vulnerabilities in GRUB2, including issues like integer overflows, buffer overflows, and a cryptographic side-channel flaw. These security flaws could allow threat actors to bypass the Unified Extensible Firmware Interface (UEFI) Secure Boot, which is designed to prevent unauthorised code from running during the boot process.

Security Copilot also discovered nine vulnerabilities in U-Boot and Barebox. These were primarily buffer overflows that affected file systems such as SquashFS, EXT4, CramFS, JFFS2, and symlinks. Notably, the threat actor would need to have physical access to the device to exploit these flaws, however, the security risk still exists.

In the case of GRUB2, Microsoft explained that the vulnerabilities could be exploited by attackers to install stealthy bootkits remotely. This is concerning, as such bootkits can persist even after reinstalling the operating system or replacing the hard drive.

The teams behind GRUB2, U-Boot, and Barebox have already released security updates in February to address these vulnerabilities. Users are advised to update their systems to the latest versions to protect themselves from potential cyberattacks.

Affiliate links may be automatically generated - see our ethics statement for details.

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

 
Show Full Article
Please wait...
Advertisement

Related Stories

Popular Mobile Brands
  1. iPhone 16 Pro, iPhone 16 Pro Max Price Discounted on Flipkart: See Offers
  2. Vivo Y400 Pro 5G With 5,500mAh Battery Launched in India: Price, Features
  3. Vivo X Fold 5 India Launch Timeline Tipped: All Details
  4. Oppo Reno 14 5G Series Global Launch Scheduled for This Date
  5. Samsung Galaxy S24 FE Gets a Price Cut on Amazon: See Offer
  6. Nothing Headphone 1 Renders Leaked Ahead of July 1 Launch: See Design
  7. Adobe Launches a New Camera App for iPhone With Full Manual Controls
  1. Samsung Galaxy S24 FE Gets a Price Cut on Amazon: See Offer
  2. Samsung Galaxy Buds Core Listed on Company Site; Design, Specifications Revealed
  3. iPhone 18 Pro Series Tipped to Get Hole-Punch Selfie Camera, Hidden Face ID System
  4. iPhone 16 Pro, iPhone 16 Pro Max Available at Discounted Prices on Flipkart: See Offers
  5. Oppo Reno 14 5G Series Global Launch Date Announced; Amazon, Flipkart Tease Online Availability in India
  6. Gigabyte Aorus Master 16 AI PC With Intel Core Ultra 9 Chip, Up to GeForce RTX 5080 GPU Launched in India
  7. Google Suffers Setback in Fight Over EU’s EUR 4.1 Billion Fine
  8. Vivo X Fold 5 India Launch Reportedly Set for Mid-July
  9. Trump Extends Deadline for US TikTok Sale to September
  10. Nothing Headphone 1 Renders and Live Images Leak Ahead of July 1 Launch; Shows Unique Design
Gadgets 360 is available in
Download Our Apps
App Store App Store
Available in Hindi
App Store
© Copyright Red Pixels Ventures Limited 2025. All rights reserved.
Trending Products »
Latest Tech News »