EDK II PXE Security Lab — CVE-2026-97631

An educational laboratory for studying a PXE network-boot vulnerability in EDK II / OVMF. It builds a pinned EDK II revision, boots a UEFI virtual machine in QEMU, and includes Python proof-of-concept scripts for investigating denial of service (DoS) and memory corruption.

References: EDK II security advisory · Upstream fix

Requirements

• Linux x86-64, internet access, and sufficient disk space for an EDK II build.
• QEMU, Python 3, and EDK II build tools. The launcher can offer to install supported distribution packages (APT, DNF, or Pacman).
• For bridge-mode experiments: dnsmasq, ip/tc (typically from iproute2 or iproute), and sudo/root privileges.

Quick Start

From the extracted archive:

cd pxe-lab-public
chmod +x *.sh
./start.sh

The launcher checks dependencies, offers to install missing packages, builds edk2-stable202608 (commit 2970e5699ba6267f3384ffab20f96647578aebc8) if needed, and opens the VM control menu. Do not run start.sh or the firmware build with sudo.

Useful commands:

./start.sh --check       # Check the environment
./start.sh --build-only  # Build the pinned firmware without starting QEMU
./start.sh --system      # Use system OVMF instead (not suitable for verifying the pinned vulnerability)
./lab_run.sh --help      # Show networking, capture, and QEMU options

The default QEMU user-mode network is isolated and does not require root. To record a packet capture, run ./lab_run.sh --pcap session.pcap after building the firmware.

Isolated PoC Experiments

The PoC scripts require bridge mode; they cannot inject packets into the default QEMU user-mode network.

First, build the firmware as a normal user with ./start.sh --build-only. Then, in one terminal:

cd pxe-lab-public
sudo ./lab.sh --network bridge --namespace pxelab

Select 1 (Start) in the menu. In a separate terminal, run one of the following from the extracted archive's root:

cd PoC-DoS
sudo bash ./start_dos.sh

Or, for the experimental memory-corruption / RCE attempt:

cd PoC-RCE
sudo bash ./start_rce.sh

These experiments send crafted traffic to the isolated virtual PXE environment and may cause a firmware hang, crash, or exception. A crash or corrupted register value is not evidence that arbitrary code execution succeeded. The RCE script is an experimental attempt, not a verified RCE exploit. Results may vary by system and firmware build.

Disclaimer

The laboratory infrastructure (setup, build, and VM management code) was generated with the assistance of a large language model (LLM) and tested by the author. The DoS and RCE proof-of-concept scripts were written personally by the author, tested with an LLM assistant. Testing does not guarantee correctness, safety, reproducibility, or compatibility with other systems.

Use this code only on equipment you own and control, in an isolated test environment. Do not use it against third-party systems, networks, or devices.

All code and scripts are provided “AS IS,” without warranties of any kind. To the maximum extent permitted by applicable law, the author disclaims liability for errors, malfunctions, damage, data loss, or consequences arising from use of this repository. Users are solely responsible for their actions and compliance with applicable laws.