OVH uefi boot - freakin' friday f*ck w/ CVE-2026-97631?

OhJohn

So as we had no (new) 0day kernel vuln this friday I used the day to remember that sth. else was swimming below the surface: CVE-2026-97631 since Oct. 2026.

This is only relevant for systems with a boot order of first testing PXEboot via UEFI - hello OVH, this is your stock settings on dedicated servers, so the question is: how save and isolated is the PXE network at OVH?

So far I have not seen any firmware updates e.g. by AMI for this for quite some Supermicro boards used at OVH.

So:

a) how do you mitigate this atm? Should we never reboot those to not open the attack vector, huh?

b) unrelated but also freaking sh*t: how do you handle efivars partition filling up by firmware? This seems to happen at those OVH servers as well - I now have one at 100% filled up for 512K efivars partition at OVH and others filling up fast as well....

regarding a) some readings:

https://status.hetzner.com/incident/54493dac-b3a2-44f0-8d8b-6de8b25d8f17

https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/

https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

plumberg

Too much effort

I wiuld power it off

OhJohn

@plumberg said: I wiuld power it off

Just never power it on again

So you have to reboot to apply all those kernel fixes, but then you are not allowed to reboot because of CVE-2026-97631 - I think i call it a day and start the weekend...

remy

just change the boot order ?
bios setup is accessible before default pxe boot

Just checked on 2 KS-LE-B
and my configuration is correct

Old servers will never receive any patch.
So you have to rely on ovh to filter the network correctly

Critical flaws everywhere, I consider all my data public at this point.

OhJohn

@remy said: So you have to rely on ovh to filter the network correctly

Yeah, ahem, I just have zero trust in them in this regard.

But blocking ICMP via their edge network firewall could help somewhat (as own sw firewall rules on server won't help) but this would not help for OVH internal traffic nor ipv6.

So changing boot order would be the best bet atm.

OhJohn

@OhJohn said: So changing boot order would be the best bet atm.

But this would also mean changing it manually each time you want to use rescue mode...