Microsoft uses AI to find flaws in GRUB2, U-Boot, Barebox bootloaders

Microsoft used Security Copilot to find 20 previously unknown vulnerabilities across GRUB2, U-Boot, and Barebox — eleven in GRUB2 (including buffer/integer overflows and a cryptographic comparison side-channel) and nine in U-Boot/Barebox (buffer overflows in various filesystem parsers). These issues can, under the right conditions, allow attackers to bypass UEFI Secure Boot and install persistent bootkits that survive OS reinstalls or drive replacement; most require local or physical access. GRUB2, U-Boot, and Barebox have released security updates to mitigate the flaws.