<story><title>Replacing exploit-ridden firmware with a Linux kernel [pdf]</title><url>https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20with%20Linux.pdf</url></story><parent_chain></parent_chain><comment><author>gghh</author><text>These slides are from the talk given at the Open Source Summit (formerly known as LinuxCon) last week in Prague. The abstract given at the talk page &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;osseu17.sched.com&amp;#x2F;event&amp;#x2F;ByYt&amp;#x2F;replace-your-exploit-ridden-firmware-with-linux-ronald-minnich-google&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;osseu17.sched.com&amp;#x2F;event&amp;#x2F;ByYt&amp;#x2F;replace-your-exploit-ri...&lt;/a&gt; is&lt;p&gt;&lt;i&gt;With the WikiLeaks release of the vault7 material, the security of the UEFI (Unified Extensible Firmware Interface) firmware used in most PCs and laptops is once again a concern. UEFI is a proprietary and closed-source operating system, with a codebase almost as large as the Linux kernel, that runs when the system is powered on and continues to run after it boots the OS (hence its designation as a “Ring -2 hypervisor&amp;quot;). It is a great place to hide exploits since it never stops running, and these exploits are undetectable by kernels and programs.&lt;/i&gt;&lt;p&gt;&lt;i&gt;Our answer to this is NERF (Non-Extensible Reduced Firmware), an open source software system developed at Google to replace almost all of UEFI firmware with a tiny Linux kernel and initramfs. The initramfs file system contains an init and command line utilities from the u-root project (&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;u-root.tk&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;u-root.tk&amp;#x2F;&lt;/a&gt;), which are written in the Go language.&lt;/i&gt;</text></comment>
<story><title>Replacing exploit-ridden firmware with a Linux kernel [pdf]</title><url>https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20with%20Linux.pdf</url></story><parent_chain></parent_chain><comment><author>Dunedan</author><text>Ever since I read that Intels UEFI reference implementation has a comparable complexity to the Linux kernel[1] I thought it&amp;#x27;s absolut nuts to have something with such a complexity just to set up the hardware for another operation system. And that&amp;#x27;s just UEFI and not even touching ME and other stuff.&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;mjg59.dreamwidth.org&amp;#x2F;10014.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;mjg59.dreamwidth.org&amp;#x2F;10014.html&lt;/a&gt;</text></comment>