Metis improves fuzzing of edk2 bootloader protocols by rehosting components
Towards Effective Fuzzing of EDK2 Components
Cryptography and Security
Summary
Bootloaders are programs that start your computer safely, and finding bugs in them is very important. The authors created Metis, a new tool that tests parts of the edk2 bootloader by running them like regular apps on your computer, which makes finding problems much easier. Metis looks at not just the main inputs but also how different parts depend on each other, improving the chances of finding bugs. Testing Metis on many components found many bugs faster and better than earlier tools.
What this means in practice
- •For firmware security teams: Detect vulnerabilities in edk2 bootloader components by testing protocols and their dependencies as user-space applications for improved security assurance.
- •For operating system developers: Improve boot-time component reliability by integrating Metis-style fuzzing harnesses for early detection of interface bugs in firmware components.
- •For embedded device manufacturers: Enhance product safety by adopting Metis to uncover and fix firmware bugs, reducing risk of remote exploitation in bootloader code.$Commercial implications: Enables sale of more secure embedded devices through advanced firmware testing capabilities directly supported by this tool.
Authors
Datta Manikanta Sri Hari Danduri, Connor Everett Glosner, Aravind Machiry
Abstract
Securing bootloaders is critical to establishing the trusted computing base of modern systems. TianoCore's edk2, the de facto UEFI-based bootloader, is widely deployed but has recently been shown to contain numerous high-severity vulnerabilities. Existing approaches either focus on post-boot interfaces or rely on heavyweight simulation, limiting their scalability, throughput, and coverage of boot-time components. We present Metis, an automated technique for fuzzing edk2 protocols (i.e., boot-time interfaces) by rehosting them as user-space applications. Our key insight is that effective fuzzing must exercise not only protocol interfaces but also their dependency interactions, which serve as additional input channels. Metis employs a Direct-dependency Component Rehosting (DCR)-based strategy to construct semantically meaningful mocks for dependencies, enabling controlled input injection across all channels. It further leverages a hybrid approach combining static analysis and Large Language Model (LLM)-guided synthesis to generate and refine fuzzing harnesses. We implement Metis on the Host Based Firmware Analyzer (HBFA) framework and evaluate it on 60 drivers covering 162 protocols. Metis achieves 73.1% coverage, approximately 1.7 times higher than FuzzUEr, the state-of-the-art edk2 fuzzing technique, and discovers 137 previously unknown bugs. We have already reported 26 of them, including 12 that are remotely triggerable, and all reported vulnerabilities have been acknowledged by the vendors.