Learn Hub

Binarly aims to harden supply chain for device and ecosystem trustworthiness

Dive into 451 Research's latest Market Insight Report on Binarly, the innovative startup tackling one of cybersecurity's most overlooked vulnerabilities - firmware security.

Reports

FEATURED

Binarly REsearch

PKfail Disclosure Report

This report provides technical details on the PKfail vulnerability, its widespread impact spanning over a decade, detection methods, and recommendations for affected users to update firmware or re-key their systems.

Reports

FEATURED

Binary Risk Hunt

Binary Risk Hunt is a free service that helps security teams and product owners confirm what their firmware and software is truly composed of. A free scan produces a custom report and SBOM file, verifying composition and exposing risks lurking below the source code.

Free Tool

No items found.

FEATURED

September 26, 2024

CVE-2024-36435 Deep-Dive: The Year’s Most Critical BMC Security Flaw

This vulnerability got our attention for many reasons: firstly, the vendor agreed on the critical impact; and secondly, the nature of the vulnerability where an unauthenticated user can remotely trigger the code flow with a simple post request and cause the arbitrary code execution over classical stack overflow (CWE-121).

Blog

No items found.

Load sort

Showing 0 of 0 results

January 9, 2023

[BRLY-2022-035] Stack memory leak vulnerability in DXE driver.

Binarly REsearch Team has discovered a stack memory leak vulnerability that allows a potential attacker to write stack memory to NVRAM variable.

Advisories

January 9, 2023

[BRLY-2022-033] Stack buffer overflow vulnerability leading to arbitrary code execution during DXE phase.

Binarly REsearch Team has discovered a stack buffer overflow vulnerability that allows an attacker to execute arbitrary code.

Advisories

January 9, 2023

[BRLY-2022-031] The stack memory leak vulnerability in DXE driver.

Binarly REsearch Team has discovered a stack memory leak vulnerability that allows a potencial attacker to write stack memory to NVRAM variable.

Advisories

January 9, 2023

[BRLY-2022-032] The stack memory leak vulnerability in DXE driver.

Binarly REsearch Team has discovered a stack memory leak vulnerability that allows a potencial attacker to write stack memory to NVRAM variable.

Advisories

January 9, 2023

[BRLY-2022-030] The stack buffer overflow vulnerability leads to arbitrary code execution during DXE phase.

Binarly REsearch Team has discovered a stack buffer overflow vulnerability that allows an attacker to execute arbitrary code.

Advisories

January 9, 2023

[BRLY-2022-029] The stack buffer overflow vulnerability leads to arbitrary code execution during DXE phase.

Binarly REsearch Team has discovered a stack buffer overflow vulnerability that allows an attacker to execute arbitrary code.

Advisories

August 15, 2022

[BRLY-2022-028] Absence or incomplete applying the Return Stack Buffer (RSB) stuffing mitigation logic before resuming from SMM.

Binarly REsearch Team discovered that most enterprise vendors are affected by not correctly applying the Return Stack Buffer (RSB) stuffing mitigation logic before resuming from SMM (RSM instruction).

Advisories

August 10, 2022

[BRLY-2022-027] The stack buffer overflow vulnerability leads to arbitrary code execution during PEI phase on Intel platform.

Binarly REsearch Team has discovered a stack buffer overflow vulnerability on Intel platforms allowing a possible attacker to execute arbitrary code during PEI phase.

Advisories

September 21, 2022

[BRLY-2022-024] SMM memory corruption vulnerability in SMM driver (SMRAM write).

Binarly REsearch Team identified an SMM memory corruption vulnerability allowing a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Advisories

September 21, 2022

[BRLY-2022-026] SMM memory corruption vulnerability in SMM driver (SMRAM write).

Advisories

September 21, 2022

[BRLY-2022-025] SMM memory leak vulnerability in SMM driver (SMRAM read).

Binarly REsearch Team identified an SMM memory leak vulnerability, which allows an attacker to read portions of SMRAM memory. This in turn could help building a successful attack vector exploiting SMM memory corruption vulnerability.

Advisories

September 21, 2022

[BRLY-2022-023] SMM memory corruption vulnerability in Software SMI handler

Binarly REsearch Team has discovered a SMM memory corruption vulnerability allowing a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Advisories

September 21, 2022

[BRLY-2022-022] SMM callout vulnerability in SMM driver (SMM arbitrary code execution).

Binarly REsearch Team identified a SMM callout, which allows an attacker to access the System Management Mode and execute arbitrary code.

Advisories

March 21, 2023

[BRLY-2022-021] The stack buffer overflow vulnerability leads to arbitrary code execution.

Binarly REsearch Team has discovered a stack buffer overflow vulnerability that allows a attacker to execute arbitrary code.

Advisories

March 23, 2023

[BRLY-2022-020] The stack buffer overflow vulnerability leads to arbitrary code execution.

Binarly REsearch Team has discovered a stack buffer overflow vulnerability that allows a attacker to execute arbitrary code.

Advisories

March 23, 2023

[BRLY-2022-019] The stack buffer overflow vulnerability leads to arbitrary code execution.

Binarly REsearch Team has discovered a stack buffer overflow vulnerability that allows a attacker to execute arbitrary code.

Advisories

September 21, 2022

[BRLY-2022-018] SMM memory leak vulnerability in SMM driver (SMRAM read).

Advisories

August 10, 2022

[BRLY-2022-016] Stack overflow vulnerability in SMI handler.

Binarly REsearch Team has discovered stack overflow vulnerability in SMI handler on Intel platforms allowing a possible attacker to execute arbitrary code in SMM.

Advisories

September 21, 2022

[BRLY-2022-017] SMM callout vulnerability in SMM driver (SMM arbitrary code execution).

Binarly REsearch Team identified an SMM callout, which allows an attacker to access the System Management Mode and execute arbitrary code.

Advisories

August 10, 2022

[BRLY-2022-011] SMM memory corruption vulnerability in SMM driver on HP device (SMRAM write).

Binarly REsearch Team has discovered an SMM memory corruption vulnerability in an HP device allowing a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Advisories

August 10, 2022

[BRLY-2022-015] The arbitrary code execution in DXE driver.

Binarly REsearch Team has discovered the ability of arbitrary code execution in DXE driver.

Advisories

August 10, 2022

[BRLY-2022-014] Arbitrary write vulnerability in PEI module leads to arbitrary code execution during PEI phase.

Binarly REsearch Team has discovered a arbitrary write vulnerability in PEI module allowing a possible attacker to execute arbitrary code during PEI phase.

Advisories

August 10, 2022

[BRLY-2022-012] SMM memory corruption vulnerability in SMM driver on HP device (SMRAM write).

Advisories

August 10, 2022

[BRLY-2022-013] SMM memory corruption vulnerability in SMM driver on HP device (SMRAM write).

Advisories

August 3, 2022

[BRLY-2022-010] SMM memory corruption vulnerability in SMM driver on HP device (SMRAM write

Advisories

September 27, 2023

A Fractured Ecosystem: Lingering Vulnerabilities in Reference Code is a Forever Problem

Uncover the challenges of lingering vulnerabilities in reference code within a fractured ecosystem. Learn how these issues impact supply chains.

Blog

September 30, 2022

ARM-based Firmware Support in New efiXplorer v5.0 [LABScon Edition]

Explore ARM-Based Firmware Support in efiXplorer v5.0 LABScon Edition. Upgrade your UEFI analysis with BINARLY's latest tool for in-depth research.

Blog

September 12, 2022

Binarly Discovers Multiple High-Severity Vulnerabilities in AMI-based Devices

Unlocking the Secrets: BINARLY Reveals High Severity Vulnerabilities in AMI Based Devices. Explore our eye-opening research findings now!

Blog

February 1, 2022

An In-Depth Look at the 23 High-Impact Vulnerabilities

Discover 23 High-Impact Vulnerabilities in Independent BIOS Developer Software. Explore the critical security flaws affecting multiple vendors.

Blog

September 10, 2021

Attacking (pre)EFI Ecosystem

Uncover critical findings on UEFI ecosystem vulnerabilities from Black Hat USA 2021. Discover key insights and solutions in safeguarding firmware supply chains.

Blog

September 8, 2022

Binarly Finds Six High Severity Firmware Vulnerabilities in HP Enterprise Devices

Discover how BINARLY uncovered 6 critical firmware vulnerabilities in HP Enterprise devices. Insights on the latest security findings await you.

Blog

October 13, 2022

Binarly Expands Leadership Team With Veteran Cybersecurity Executives

Elevate enterprise firmware security with BINARLY's expert leadership team. Industry veterans from BlackBerry and Dragos join forces for enhanced protection.

Blog

August 23, 2022

Black Hat 2022: Blasting Event-Driven Cornucopia - WMI edition

Uncover cutting-edge insights into firmware vulnerabilities and persistence methods at the Black Hat 2022 Blasting Event - WMI edition. Dive in now!

Blog

April 3, 2023

Binarly Reports High-Severity AMD Vulnerabilities with Downstream Impact

Discover How BINARLY Reports High Severity AMD Vulnerabilities with Industry Impact | AMD Client Vulnerabilities Revealed - BINARLY Research Team's Findings.

Blog

August 16, 2022

Black Hat 2022: The Intel PPAM attack story

Discover the dark world of firmware vulnerabilities and persistent cyber threats with Black Hat 2022. Unveiling the Intel PPAM attack story and more!

Blog

November 15, 2021

Design issues of modern EDRs: bypassing ETW-based solutions

Enhance firmware security with insights on modern EDR design flaws bypassing ETW-based solutions. Learn more from BINARLY experts at Black Hat Europe 2021.

Blog

July 14, 2021

Breaking through another Side: Bypassing Firmware Security Boundaries

Unlock secrets of firmware security bypass with this BlackHat 2019 research on embedded controller vulnerabilities in Lenovo Thinkpad BIOS. Learn more!

Blog

June 22, 2022

Firmware Supply Chain Company Binarly Raises $3.6 Million from Westwave Capital, Acrobator Ventures

Empower your firmware security with BINARLY - Innovating the supply chain with cutting-edge binary code analysis. Learn how we're reshaping cybersecurity!

Blog

December 20, 2022

efiXplorer: Hunting UEFI Firmware NVRAM Vulnerabilities

Explore UEFI firmware vulnerabilities with efiXplorer v5.2 [Xmas Edition]. Enhance your code analysis and SMM call-out detection capabilities. Upgrade now!

Blog

September 14, 2021

Detecting Firmware vulnerabilities at scale: Intel BSSA DFT case study

Discover how Intel efficiently detects firmware vulnerabilities at scale in this insightful BSSA DFT case study. Uncover key findings and strategies.

Blog

October 4, 2022

LABScon 2022: Binarly Discloses High-Impact Firmware Vulnerabilities In Insyde-Based Devices

Discover high-impact firmware vulnerabilities in Insyde-based devices in the 2022 LABScon report. Learn more about these critical findings today.

Blog

July 18, 2022

FirmwareBleed: The industry fails to adopt Return Stack Buffer mitigations in SMM

Discover why the industry lags in implementing Return Stack Buffer mitigations in SMM firmware. Learn how to enhance security measures effectively.

Blog

September 16, 2024

Binarly to Unveil New Findings on Critical PKfail Issue at LABScon 2024

Binarly will present significant new insights into the critical PKfail vulnerability at this week’s LABScon 2024 conference. The research will be presented by Binarly founder and CEO Alex Matrosov, alongside vulnerability research lead, Fabio Pagani.

Learn

Binarly aims to harden supply chain for device and ecosystem trustworthiness

PKfail Disclosure Report

Binary Risk Hunt

CVE-2024-36435 Deep-Dive: The Year’s Most Critical BMC Security Flaw

[BRLY-2022-035] Stack memory leak vulnerability in DXE driver.

[BRLY-2022-033] Stack buffer overflow vulnerability leading to arbitrary code execution during DXE phase.

[BRLY-2022-031] The stack memory leak vulnerability in DXE driver.

[BRLY-2022-032] The stack memory leak vulnerability in DXE driver.

[BRLY-2022-030] The stack buffer overflow vulnerability leads to arbitrary code execution during DXE phase.

[BRLY-2022-029] The stack buffer overflow vulnerability leads to arbitrary code execution during DXE phase.

[BRLY-2022-028] Absence or incomplete applying the Return Stack Buffer (RSB) stuffing mitigation logic before resuming from SMM.

[BRLY-2022-027] The stack buffer overflow vulnerability leads to arbitrary code execution during PEI phase on Intel platform.

[BRLY-2022-024] SMM memory corruption vulnerability in SMM driver (SMRAM write).

[BRLY-2022-026] SMM memory corruption vulnerability in SMM driver (SMRAM write).

[BRLY-2022-025] SMM memory leak vulnerability in SMM driver (SMRAM read).

[BRLY-2022-023] SMM memory corruption vulnerability in Software SMI handler

[BRLY-2022-022] SMM callout vulnerability in SMM driver (SMM arbitrary code execution).

[BRLY-2022-021] The stack buffer overflow vulnerability leads to arbitrary code execution.

[BRLY-2022-020] The stack buffer overflow vulnerability leads to arbitrary code execution.

[BRLY-2022-019] The stack buffer overflow vulnerability leads to arbitrary code execution.

[BRLY-2022-018] SMM memory leak vulnerability in SMM driver (SMRAM read).

[BRLY-2022-016] Stack overflow vulnerability in SMI handler.

[BRLY-2022-017] SMM callout vulnerability in SMM driver (SMM arbitrary code execution).

[BRLY-2022-011] SMM memory corruption vulnerability in SMM driver on HP device (SMRAM write).

[BRLY-2022-015] The arbitrary code execution in DXE driver.

[BRLY-2022-014] Arbitrary write vulnerability in PEI module leads to arbitrary code execution during PEI phase.

[BRLY-2022-012] SMM memory corruption vulnerability in SMM driver on HP device (SMRAM write).

[BRLY-2022-013] SMM memory corruption vulnerability in SMM driver on HP device (SMRAM write).

[BRLY-2022-010] SMM memory corruption vulnerability in SMM driver on HP device (SMRAM write

A Silent Threat in Our Devices: The BlackTech Firmware Attacks

A deeper UEFI dive into MoonBounce

Firmware Patch Deep-Dive: Lenovo Patches Fail to Fix Underlying Vulnerabilities

A Fractured Ecosystem: Lingering Vulnerabilities in Reference Code is a Forever Problem

ARM-based Firmware Support in New efiXplorer v5.0 [LABScon Edition]

Binarly Discovers Multiple High-Severity Vulnerabilities in AMI-based Devices

An In-Depth Look at the 23 High-Impact Vulnerabilities

Attacking (pre)EFI Ecosystem

Binarly Finds Six High Severity Firmware Vulnerabilities in HP Enterprise Devices

Binarly Expands Leadership Team With Veteran Cybersecurity Executives

Black Hat 2022: Blasting Event-Driven Cornucopia - WMI edition

Binarly Reports High-Severity AMD Vulnerabilities with Downstream Impact

Black Hat 2022: The Intel PPAM attack story

Design issues of modern EDRs: bypassing ETW-based solutions

Breaking through another Side: Bypassing Firmware Security Boundaries

Firmware Supply Chain Company Binarly Raises $3.6 Million from Westwave Capital, Acrobator Ventures

efiXplorer: Hunting UEFI Firmware NVRAM Vulnerabilities

Detecting Firmware vulnerabilities at scale: Intel BSSA DFT case study

LABScon 2022: Binarly Discloses High-Impact Firmware Vulnerabilities In Insyde-Based Devices

FirmwareBleed: The industry fails to adopt Return Stack Buffer mitigations in SMM

Binarly to Unveil New Findings on Critical PKfail Issue at LABScon 2024

Binarly Unveils Transparency Platform 2.5 with Advanced Reachability Analysis‍

Report from 451 Research Highlights Binarly's Unique Approach to Software Supply Chain Security

Binarly Launches Next-Generation Transparency Platform to Elevate Software Supply Chain Security

Binarly Releases Free Detection Tool for XZ Backdoor

Software Supply Chain Security Leader Binarly Closes $10.5 Million Financing Led by Two Bear Capital

Binarly Wins Spot in Inaugural Google for Startups Accelerator Program

Binarly Wins Finalist Spot at Black Hat Startup Spotlight Competition

Binarly Announces Additions to Product Strategy, Leadership Team

Binarly CEO to Present Cross-Silicon Firmware Vulnerabilities Affecting Ecosystems of Intel, AMD, and Qualcomm

Binarly Discloses Multiple Firmware Vulnerabilities in Qualcomm and Lenovo ARM-based Devices

Binarly Executives to Present on Firmware Security at Black Hat Briefings 2022

Binarly Presents New Firmware Vulnerabilities at LABScon 2022

Binarly Discovers High-Impact Vulnerabilities in Firmware Impacting Millions of Enterprise Devices

Binarly partners with immune to secure hardware, firmware and software supply chain

Binarly Expands Leadership Team With Veteran Cybersecurity Executives

Binarly Unveils Next-Gen Firmware Protection Transparency Platform, Revolutionizing Device Supply Chain Security

Firmware Supply Chain Pioneers Binarly Raises $3.6 Million from Westwave Capital, Acrobator Ventures

Binarly Releases FwHunt.run Project to Scale Firmware Threat Detection

Binarly Discovers 16 New, High-Impact Vulnerabilities in Firmware Affecting HP Enterprise Devices

Significant PKfail vulnerability continues to be prevalent

PKfail Secure Boot bypass remains a significant risk two months later

'PKfail' Secure Boot disaster just went from bad to worse

Secure Boot-neutering PKfail debacle is more prevalent than anyone knew

Secure Boot is completely broken on 200+ models from 5 big device makers

How to find outdated lighttpd services

Six-year old bug will likely live forever in Lenovo, Intel products

Hackable Intel and Lenovo hardware that went undetected for 5 years won’t ever be fixed

Intel and Lenovo servers impacted by 6-year-old BMC flaw

The XZ Backdoor: Everything You Need to Know