Headless QEMU/OVMF harness that drives a PXE boot and fires oversized ICMP errors to reproduce the EDK II PxeBcSupport buffer overflow (CVE-2026-97631) in a local lab.
⚠️ LOCAL LAB ONLY. These tools drive a local QEMU VM against a firmware you control. Never point the ICMP generator at hardware or networks you don't own.
CVE-2026-97631: a 16-year-old buffer overflow in TianoCore EDK II
(NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c) — an oversized ICMP error message
during a PXE network boot copies past the 504-byte EFI_PXE_BASE_CODE_ICMP_ERROR
struct, corrupting firmware memory in ring 0, before Secure Boot and TPM load.
Fixed by PR #13200 /
#13302; disclosure coverage:
Ars Technica.
Three small stdlib-only pieces that take a headless OVMF/QEMU VM from cold boot to a PXE boot attempt — with a DHCP server and the ICMP attack on the wire:
| file | role |
|---|---|
bridge.py | minimal DHCP server on the QEMU wire (DISCOVER→OFFER→REQUEST→ACK, TFTP RRQ wait), then fires the attack: 6× ICMP type-3 code-1 errors quoting a 1200-byte fake datagram into the 504-byte struct. --attack on/off. |
router.py | screen-state router: classifies OVMF's screen from screendump pixel statistics (black = UEFI Shell, blue = front page / Boot Manager) and drives the UI through the QEMU monitor (sendkey) until the PXE boot option runs. |
drive.py | earlier step-by-step keyboard driver with PPM highlight-bar detection (kept for reference). |
Run shape:
# VM: OVMF pflash, virtio-net on a UDP socket netdev (no mcast flakiness),
# pcap wire tap + CPU-reset logging:
qemu-system-x86_64 -machine q35 -m 512 -display none \
-drive if=pflash,format=raw,readonly=on,file=$FW-code.fd \
-drive if=pflash,format=raw,file=$FW-vars.fd \
-netdev socket,id=n0,udp=127.0.0.1:5555,localaddr=127.0.0.1:6666 \
-device virtio-net-pci,netdev=n0,bootindex=0 \
-object filter-dump,id=f1,netdev=n0,file=dump.pcap \
-monitor unix:qmon.sock,server,nowait -serial none -d cpu_reset -D resets.log &
python3 bridge.py --attack & # DHCP + ICMP overflow trigger
python3 router.py qmon.sock run.log # navigate headlessly to UEFI PXE IPv4
tcpdump -r dump.pcpa # wire truth
grep -c "CPU Reset" resets.log # crash signal (baseline: 2 on clean boot)
Everything up to the PXE boot attempt works reproducibly (screen-state routing, wire tap, DHCP/attack engine armed). On the QEMU-bundled OVMF builds we tested (IA32 and X64, q35 and i440fx, TCG), the firmware displays the PXE banner and then transmits zero packets — the DHCP Discover never leaves the firmware, so the ICMP trigger never reaches the vulnerable handler. Going further needs a serial-debug OVMF build or real lab hardware. The harness is published to this exact boundary on purpose: reproducibility claims must stop where the run stopped.
MIT. By @slabbdev — companion to the blog write-up.