Michael Brown
d00df0822b
With suitable guidance, AI agents such as Claude Code are capable of scanning effectively for potential vulnerabilities, and reporting them in a concise and actionable format. These tools are now widely available to malicious actors, and so any vulnerabilities that they are capable of finding must be fixed now before they are inevitably found and potentially exploited. The recent batch of commits over the past week closes all potential vulnerabilities that were detectable by either Opus 4.8 or Fable in multiple passes over the code. No serious security impact was found, and there is nothing that would merit a UEFI Secure Boot revocation. A concrete threat model is now documented, along with the explicit bounds contracts for several internal APIs (such as ASN.1 parsing and I/O buffer pointer manipulation). Some entire classes of nominal defect (e.g. technically undefined behaviour arising from constant left shifts into the sign bit) have been eliminated. False positives that were raised several times and that could not be silenced through reporting guidelines were fixed in the code, even when the code change had no real-world impact. It is now possible to ask an appropriately instructed AI agent to search for vulnerabilities in the iPXE codebase and to be reasonably confident that anything that it reports is worth investigating further. Add a security policy to formally document the expectations upon both humans and AI agents in terms of reporting potential vulnerabilities, and update the contribution guidelines to grant a limited exception to the blanket ban on AI-generated text. Signed-off-by: Michael Brown <mcb30@ipxe.org>
3.2 KiB
Security reporting
Thank you for wanting to help to improve the security of iPXE!
If you believe that you have found a vulnerability in iPXE, please first check that whatever you have found is still present in the latest commit on the upstream master branch.
Having checked that your finding is still present in iPXE, please then check against the defined threat model document (source file) to make sure that what you have found is within scope and worth reporting. In particular, make sure to check the "Exclusions" portion of that document.
Once you are sure that you have found something that is still present in iPXE and that falls within the threat model, please verify that the vulnerability is real. A working exploit is not required, only a brief justification of the reasoning.
Reporting
Please submit any human-written vulnerability report as a GitHub Security Advisory against the upstream iPXE repository.
If the vulnerability report is generated by an AI agent, then you must instead submit the report as a GitHub Security Advisory against the separate iPXE AI repository.
Do not use public issue reports or pull requests to report suspected vulnerabilities.
You can leave almost all fields blank in the report. All that is required is the title and description, which should be no more than five to ten lines of text. Verbose reports are likely to go unread, and verbose AI-generated reports will result in the responsible user being banned as per the "(Ab)use of AI" policy in the contribution guidelines.
A good example report (from a real historical example) is as follows:
fcoe.c:522: received FIP descriptor lengths are not validated
fcoe_fip_parse()stores pointers to recognised FIP descriptor types but never validates that descriptor lengthdesc_lenis sufficient to hold the descriptor:if ( ( desc_type > FIP_RESERVED ) && ( desc_type < FIP_NUM_DESCRIPTOR_TYPES ) ) { /* Use only the first instance of a descriptor */ if ( descs->desc[desc_type] == NULL ) descs->desc[desc_type] = desc; continue; }
That report contains exactly the right amount of information needed to identify and fix the problem. There is no need to report extraneous information such as your compiler version, QEMU version, shoe size, favourite sandwich filling, a Dockerfile, etc.
Credit
If the vulnerability is real, then you will receive at least a
Reported-by credit in the commit that fixes it. More complex
investigations (requiring substantial time and effort on your part)
will be upgraded to a Debugged-by credit.
Please be sure to include both your real name and email address within the GitHub Security Advisory, so that we can give you the credit that you deserve.
Many thanks for helping to improve iPXE for everyone!