Pierluigi Paganini
March 09, 2022
Researchers from cybersecurity firm Binarly discovered 16 high-severity vulnerabilities in various implementations of Unified Extensible Firmware Interface (UEFI) firmware impacting multiple HP enterprise devices.
An attacker can exploit these vulnerabilities to implant a firmware that survives operating system updates and bypasses UEFI Secure Boot, Intel Boot Guard, and virtualization-based security.
Impacted devices include multiple HP enterprise devices, including laptops, desktops, point-of-sale systems, and edge computing nodes.
“By exploiting the vulnerabilities disclosed, attackers can leverage them to perform privileged code execution in firmware, below the operating system, and potentially deliver persistent malicious code that survives operating system re-installations and allows the bypass of endpoint security solutions (EDR/AV), Secure Boot and Virtualization-Based Security isolation.” reads the analysis published by Binarly.
Below is the list of vulnerabilities discovered by the researchers:
| CVE ID | BINARLY ID | Description | CVSS Score |
|---|---|---|---|
| CVE-2021-39297 | BRLY-2021-003 | DXE stack buffer overflow (arbitrary code execution) | 7.7 High |
| CVE-2021-39298 | BRLY-2021-004 | SMM callout (privilege escalation) | 8.8 High |
| CVE-2021-39299 | BRLY-2021-005 | DXE stack buffer overflow (arbitrary code execution) | 8.2 High |
| CVE-2021-39300 | BRLY-2021-006 | DXE stack overflow vulnerability (arbitrary code execution) | 8.2 High |
| CVE-2021-39301 | BRLY-2021-007 | DXE stack overflow (arbitrary code execution) | 7.7 High |
| CVE-2022-23924 | BRLY-2021-032 | SMM heap buffer overflow (arbitrary code execution) | 8.2 High |
| CVE-2022-23925 | BRLY-2021-033 | SMM memory corruption (arbitrary code execution) | 8.2 High |
| CVE-2022-23926 | BRLY-2021-034 | SMM memory corruption (arbitrary code execution) | 8.2 High |
| CVE-2022-23927 | BRLY-2021-035 | SMM memory corruption (arbitrary code execution) | 8.2 High |
| CVE-2022-23928 | BRLY-2021-036 | SMM memory corruption (arbitrary code execution) | 8.2 High |
| CVE-2022-23929 | BRLY-2021-037 | SMM memory corruption (arbitrary code execution) | 8.2 High |
| CVE-2022-23930 | BRLY-2021-038 | SMM memory corruption (arbitrary code execution) | 8.2 High |
| CVE-2022-23931 | BRLY-2021-039 | SMM memory corruption (arbitrary code execution) | 8.2 High |
| CVE-2022-23932 | BRLY-2021-040 | SMM callout (privilege escalation) | 8.2 High |
| CVE-2022-23933 | BRLY-2021-041 | SMM callout (privilege escalation) | 8.2 High |
| CVE-2022-23934 | BRLY-2021-042 | SMM memory corruption (arbitrary code execution) | 8.2 High |
“Binarly believes that the lack of a knowledge base of common firmware exploitation techniques and primitives related to UEFI firmware makes these failures repeatable for the entire industry. We are working hard to fill this gap by providing comprehensive technical details in our advisories. This knowledge base is crucial for developing effective mitigations and defense technologies for device security.”,
said Alex Matrosov, Founder and CEO at Binarly.
The most severe of the vulnerabilities discovered by the researchers are memory corruption issues affecting the System Management Mode (SMM) of the firmware. An attacker could trigger them to gain arbitrary code execution with the highest privileges.
HP addressed the flaws with the release of HP UEFI Firmware February 2022 security updates issued in February.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, SIM swapping)
[adrotate banner=”5″]
[adrotate banner=”13″]
Cyber Crime / December 26, 2024
