Information about the vulnerability (CVE-2021-33164) in UEFI firmware has been revealed. This vulnerability allows code execution at the SMM (System Management Mode) level, which prioritizes over hypervisor mode and the zero protection ring, providing unrestricted access to the entire system memory. The vulnerability, codenamed RingHopper, is related to the potential for a timing attack using DMA (Direct Memory Access) to corrupt memory in code executed at the SMM level. The vulnerability has been confirmed in the firmware of Intel, Dell, and Insyde Software (it is claimed that the issue affects 8 manufacturers, but the other 5 are not yet disclosed). AMD, Phoenix, and Toshiba firmware are not affected by the issue. <\/p>\n
Exploitation of the vulnerabilities can be carried out from the operating system using vulnerable SMI handlers (System Management Interrupt), access to which requires administrator rights. An attack can also be conducted with physical access during the early boot phase, prior to operating system initialization. To mitigate the issue, Linux users are recommended to update the firmware using the LVFS (Linux Vendor Firmware Service), utilizing the fwupdmgr utility (fwupdmgr get-updates; fwupdmgr update) from the fwupd package. <\/p>\n
The requirement for administrator rights to conduct an attack limits the danger of the issue, but does not prevent its use as a second-tier vulnerability, to maintain presence after exploiting other vulnerabilities in the system or using social engineering methods. Access to SMM (Ring -2) allows code execution at a level beyond the operating system's control, which can be used to modify firmware and embed hidden malicious code or rootkits in SPI Flash that are undetectable from the operating system, as well as to disable verification at the boot stage (UEFI Secure Boot, Intel BootGuard) and conduct attacks on hypervisors to bypass the integrity check mechanisms of virtual environments. <\/p>\n
Problemet skyldes en race condition i SMI (System Management Interrupt) h\u00e5ndtereren, der opst\u00e5r i det \u00f8jeblik, hvor der tjekkes for adgang og der foretages et kald til SMRAM. For at bestemme det n\u00f8dvendige tidspunkt mellem tjekket af tilstanden og brugen af resultatet kan der anvendes analyse via eksterne kanaler ved hj\u00e6lp af DMA. Som et resultat af den asynkrone karakter af adgangen til SMRAM via DMA, kan angriberen bestemme det n\u00f8dvendige tidspunkt og overskrive indholdet af SMRAM ved hj\u00e6lp af DMA uden om API'en for SMI h\u00e5ndtereren. Processorer med st\u00f8tte til Intel-VT og Intel VT-d mekanismer inkluderer beskyttelse mod DMA-angreb, baseret p\u00e5 brugen af IOMMU (Input-Output Memory Management Unit), men denne beskyttelse er effektiv til at blokere hardware DMA-angreb, der udf\u00f8res ved hj\u00e6lp af specielt forberedte enheder af angriberen, og beskytter ikke mod angreb via SMI-h\u00e5ndterere. \u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RingHopper, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DMA (Direct Memory Access) \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105506","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i UEFI firmware, der muligg\u00f8r udf\u00f8relse af kode p\u00e5 SMM niveau | ProHoster","description":"Information om s\u00e5rbarheden (CVE-2021-33164) i UEFI firmware er blevet afsl\u00f8ret, som muligg\u00f8r udf\u00f8relse af kode p\u00e5 SMM (System Management Mode) niveau, som har h\u00f8jere prioritet end hypervisorens tilstand og den nul beskyttelsesring.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-09T01:36:39+00:00","article:modified_time":"2022-11-09T01:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/105506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=105506"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/105506\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=105506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=105506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=105506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"