mirror of
https://github.com/ipxe/ipxe.git
synced 2026-08-26 13:17:22 -05:00
Michael Brown
d00df0822b
With suitable guidance, AI agents such as Claude Code are capable of scanning effectively for potential vulnerabilities, and reporting them in a concise and actionable format. These tools are now widely available to malicious actors, and so any vulnerabilities that they are capable of finding must be fixed now before they are inevitably found and potentially exploited. The recent batch of commits over the past week closes all potential vulnerabilities that were detectable by either Opus 4.8 or Fable in multiple passes over the code. No serious security impact was found, and there is nothing that would merit a UEFI Secure Boot revocation. A concrete threat model is now documented, along with the explicit bounds contracts for several internal APIs (such as ASN.1 parsing and I/O buffer pointer manipulation). Some entire classes of nominal defect (e.g. technically undefined behaviour arising from constant left shifts into the sign bit) have been eliminated. False positives that were raised several times and that could not be silenced through reporting guidelines were fixed in the code, even when the code change had no real-world impact. It is now possible to ask an appropriately instructed AI agent to search for vulnerabilities in the iPXE codebase and to be reasonably confident that anything that it reports is worth investigating further. Add a security policy to formally document the expectations upon both humans and AI agents in terms of reporting potential vulnerabilities, and update the contribution guidelines to grant a limited exception to the blanket ban on AI-generated text. Signed-off-by: Michael Brown <mcb30@ipxe.org>
83 lines
3.2 KiB
Markdown
83 lines
3.2 KiB
Markdown
Security reporting
|
|
==================
|
|
|
|
Thank you for wanting to help to improve the security of iPXE!
|
|
|
|
If you believe that you have found a vulnerability in iPXE, please
|
|
first check that whatever you have found is still present in the
|
|
latest commit on the [upstream][ipxe] master branch.
|
|
|
|
Having checked that your finding is still present in iPXE, please then
|
|
check against the defined [threat model][threats] document ([source
|
|
file](src/doc/threat_model.dox)) to make sure that what you have found
|
|
is within scope and worth reporting. In particular, make sure to
|
|
check the "Exclusions" portion of that document.
|
|
|
|
Once you are sure that you have found something that is still present
|
|
in iPXE and that falls within the threat model, please verify that the
|
|
vulnerability is real. A working exploit is not required, only a
|
|
brief justification of the reasoning.
|
|
|
|
Reporting
|
|
---------
|
|
|
|
Please [submit][secadv] any human-written vulnerability report as a
|
|
GitHub Security Advisory against the upstream [iPXE][ipxe] repository.
|
|
|
|
If the vulnerability report is generated by an AI agent, then you must
|
|
instead [submit][aisecadv] the report as a GitHub Security Advisory
|
|
against the separate [iPXE AI][aipxe] repository.
|
|
|
|
Do not use public issue reports or pull requests to report suspected
|
|
vulnerabilities.
|
|
|
|
You can leave almost all fields blank in the report. All that is
|
|
required is the title and description, which should be no more than
|
|
five to ten lines of text. Verbose reports are likely to go unread,
|
|
and verbose AI-generated reports will result in the responsible user
|
|
being banned as per the "(Ab)use of AI" policy in the [contribution
|
|
guidelines](CONTRIBUTING.md).
|
|
|
|
A good example report (from a real historical example) is as follows:
|
|
|
|
> `fcoe.c:522`: received FIP descriptor lengths are not validated
|
|
>
|
|
> `fcoe_fip_parse()` stores pointers to recognised FIP descriptor
|
|
> types but never validates that descriptor length `desc_len` is
|
|
> sufficient to hold the descriptor:
|
|
> ```
|
|
> if ( ( desc_type > FIP_RESERVED ) &&
|
|
> ( desc_type < FIP_NUM_DESCRIPTOR_TYPES ) ) {
|
|
> /* Use only the first instance of a descriptor */
|
|
> if ( descs->desc[desc_type] == NULL )
|
|
> descs->desc[desc_type] = desc;
|
|
> continue;
|
|
> }
|
|
> ```
|
|
|
|
That report contains exactly the right amount of information needed to
|
|
identify and fix the problem. There is no need to report extraneous
|
|
information such as your compiler version, QEMU version, shoe size,
|
|
favourite sandwich filling, a Dockerfile, etc.
|
|
|
|
Credit
|
|
------
|
|
|
|
If the vulnerability is real, then you will receive at least a
|
|
`Reported-by` credit in the commit that fixes it. More complex
|
|
investigations (requiring substantial time and effort on your part)
|
|
will be upgraded to a `Debugged-by` credit.
|
|
|
|
Please be sure to include both your real name and email address within
|
|
the GitHub Security Advisory, so that we can give you the credit that
|
|
you deserve.
|
|
|
|
Many thanks for helping to improve iPXE for everyone!
|
|
|
|
|
|
[aipxe]: https://github.com/ipxe/aipxe
|
|
[aisecadv]: https://github.com/ipxe/aipxe/security/advisories/new
|
|
[ipxe]: https://github.com/ipxe/ipxe
|
|
[secadv]: https://github.com/ipxe/ipxe/security/advisories/new
|
|
[threats]: https://dox.ipxe.org/threat_model.html
|