Post

is that good?

i guess the Fun question is: how do you know your production servers haven't been rooted? and is it safer to roll everything to new firmware or to assume you're fine?

From what I see it is based on ICMP, a network function.  Turning off the UEFI BIOS network module and using a secondary boot-loader to handle network boot if needed should be a functional workaround until the BIOS is patched. I don't know why network functions are being run before secure boot.

Basically, as soon as CPU 0, or even the CPU or Chipset uncore is functional, everything after that should be verified by secureboot until you hit the final bootstrap, at which point secureboot can be disabled at the user's choice.