The paper discusses the security implications of image parsing during system boot and how it can be exploited by attackers to gain unauthorized access to the system. The authors demonstrate several attacks that can be launched using image parsing, including logo manipulation, firmware vulnerabilities, and bootloader attacks. CERT/CC’s coordinated advisory tracks the parser bugs in AMI (CVE-2023-39539), Insyde (CVE-2023-40238) and Phoenix (CVE-2023-5058) firmware, and AMI separately assigned CVE-2023-39538 for the BMP variant of its PNG bug.
