Pierluigi Paganini
January 07, 2015
The CERT/CC has issued three different advisories for security flaws identified in the Unified Extensible Firmware Interface (UEFI).
The Unified Extensible Firmware Interface (UEFI) (pronounced as an initialism U-E-F-I or like “unify” without the n) is a specification that defines a software interface between an operating system and platform firmware. UEFI is meant to replace the Basic Input/Output System (BIOS) firmware interface, present in all IBM PC-compatible personal computers.[1][2] In practice, most UEFI images provide legacy support for BIOS services. UEFI can support remote diagnostics and repair of computers, even without another operating system.” reports by Wikipedia.
The serious holes were identified by the researchers Rafal Wojtczuk of Bromium and Corey Kallenberg of The MITRE Corporation.
The security advisories published by CERT/CC confirm that potentially impacted vendors were notified in September and October. Unfortunately, many of the alerted organizations still haven’t determined if their solutions are affected by the vulnerability.
Earlier June 2014, Corey Kallenberg at the Hack in the Box 2014 security conference in Amsterdam demonstrated that the Secure Boot security mechanism of the UEFI (Unified Extensible Firmware Interface) can be circumvented on around half of the PCs that was using it. This time the experts disclosed the UEFI flaw in a presentation made at the last edition of the Chaos Communication Congress (CCC) in Germany in December.
The first flaw identified by the experts, coded CVE-2014-8274, can be exploited by a local, authenticated attacker to bypass firmware write protections.
According to the researchers, the issue exists because access to the boot script used by the EFI S3 Resume Boot Path is not properly restricted.
“An authenticated local attacker may be able to bypass Secure Boot and/or perform an arbitrary reflash of the platform firmware despite the presence of signed firmware update enforcement. Additionally, the attacker could arbitrarily read or write to the SMRAM region. Lastly, the attacker could corrupt the platform firmware and cause the system to become inoperable,” CERT/CC reported in its security advisory.
Another vulnerability, coded as CVE-2014-8273, is a race condition , also known as Concurrent Execution using Shared Resource with Improper Synchronization, affecting certain Intel chipsets and it can be exploited by a local, authenticated attacker to bypass the BIOS write protection mechanism. The hackers can exploit it to write malicious code to the platform firmware or to corrupt the firmware with the intent to cause the system to become inoperable.
A third hole disclosed by the researchers Wojtczuk and Kallenberg is a buffer overflow flaw in the EDK1 UEFI reference implementation and was coded as CVE-2014-8274.
“The impact of the vulnerability depends on the earliness at which the vulnerable code can be instantiated. Generally, as the boot up of the platform progresses, the platform becomes more and more locked down. Specifically, things like the SPI Flash containing the platform firmware, [System Management Mode (SMM)], and other chipset configurations become locked,” explained Wojtczuk and Kallenberg. “In an ideal (for attacker) scenario, the vulnerable code can be instantiated before the SPI flash is locked down, thus resulting in an arbitrary reflash of the platform firmware.”
The vulnerabilities impact many popular UEFI firmware, including Insyde Software products (CVE-2014-8271), American Megatrends Incorporated (AMI) and Phoenix Technologies (CVE-2014-8273, CVE-2014-8274). CVE-2014-8274 has been confirmed also by Intel solutions.
Last week, I posted the findings made by the expert Trammell Hudson that at the CCC presented a technique dubbed Thunderstrike hack to infect Apple’s Mac PCs with with EFI Bootkit through the Thunderbolt port.
(Security Affairs – UEFI, hack, hacking)
Data Breach / November 21, 2024
