CERT CC warns about critical flaws in UEFI implementations

The Carnegie Mellon University CERT/CC warned about the presence of serious vulnerabilities in the Unified Extensible Firmware Interface (UEFI).

The CERT/CC has issued three different advisories for security flaws identified in the Unified Extensible Firmware Interface (UEFI).

The Unified Extensible Firmware Interface (UEFI) (pronounced as an initialism U-E-F-I or like “unify” without the n) is a specification that defines a software interface between an operating system and platform firmware. UEFI is meant to replace the Basic Input/Output System (BIOS) firmware interface, present in all IBM PC-compatible personal computers.^[1]^[2] In practice, most UEFI images provide legacy support for BIOS services. UEFI can support remote diagnostics and repair of computers, even without another operating system.” reports by Wikipedia.

The serious holes were identified by the researchers Rafal Wojtczuk of Bromium and Corey Kallenberg of The MITRE Corporation.

The security advisories published by CERT/CC confirm that potentially impacted vendors were notified in September and October. Unfortunately, many of the alerted organizations still haven’t determined if their solutions are affected by the vulnerability.

Earlier June 2014, Corey Kallenberg at the Hack in the Box 2014 security conference in Amsterdam demonstrated that the Secure Boot security mechanism of the UEFI (Unified Extensible Firmware Interface) can be circumvented on around half of the PCs that was using it. This time the experts disclosed the UEFI flaw in a presentation made at the last edition of the Chaos Communication Congress (CCC) in Germany in December.

The first flaw identified by the experts, coded CVE-2014-8274, can be exploited by a local, authenticated attacker to bypass firmware write protections.

According to the researchers, the issue exists because access to the boot script used by the EFI S3 Resume Boot Path is not properly restricted.

“An authenticated local attacker may be able to bypass Secure Boot and/or perform an arbitrary reflash of the platform firmware despite the presence of signed firmware update enforcement. Additionally, the attacker could arbitrarily read or write to the SMRAM region. Lastly, the attacker could corrupt the platform firmware and cause the system to become inoperable,” CERT/CC reported in its security advisory.

Another vulnerability, coded as CVE-2014-8273, is a race condition , also known as Concurrent Execution using Shared Resource with Improper Synchronization, affecting certain Intel chipsets and it can be exploited by a local, authenticated attacker to bypass the BIOS write protection mechanism. The hackers can exploit it to write malicious code to the platform firmware or to corrupt the firmware with the intent to cause the system to become inoperable.

A third hole disclosed by the researchers Wojtczuk and Kallenberg is a buffer overflow flaw in the EDK1 UEFI reference implementation and was coded as CVE-2014-8274.

“The impact of the vulnerability depends on the earliness at which the vulnerable code can be instantiated. Generally, as the boot up of the platform progresses, the platform becomes more and more locked down. Specifically, things like the SPI Flash containing the platform firmware, [System Management Mode (SMM)], and other chipset configurations become locked,” explained Wojtczuk and Kallenberg. “In an ideal (for attacker) scenario, the vulnerable code can be instantiated before the SPI flash is locked down, thus resulting in an arbitrary reflash of the platform firmware.”

The vulnerabilities impact many popular UEFI firmware, including Insyde Software products (CVE-2014-8271), American Megatrends Incorporated (AMI) and Phoenix Technologies (CVE-2014-8273, CVE-2014-8274). CVE-2014-8274 has been confirmed also by Intel solutions.

Last week, I posted the findings made by the expert Trammell Hudson that at the CCC presented a technique dubbed Thunderstrike hack to infect Apple’s Mac PCs with with EFI Bootkit through the Thunderbolt port.

Pierluigi Paganini

(Security Affairs – UEFI, hack, hacking)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.