A vulnerability (CVE-2024-0762) has been identified in the Phoenix SecureCore UEFI firmware used in many laptops, PCs, and servers with Intel processors, allowing code execution at the firmware level if system access is obtained. This vulnerability can be exploited after a successful attack on the system to leave a backdoor in the firmware that operates above the operating system, bypassing OS security mechanisms, remaining undetected by malware detection software, and persisting after an OS reinstallation.
The vulnerability is caused by the unsafe use of the TCG2_CONFIGURATION variable in the TPM (Trusted Platform Module) configuration, manipulation of which can lead to a buffer overflow and potential execution of code with UEFI firmware privileges, i.e., at the SMM (System Management Mode) level, which has a higher priority than hypervisor mode and ring zero protection, providing unrestricted access to all system memory. The vulnerability exists in the TPM configuration handling code in UEFI and manifests regardless of the presence of a TPM chip.
The cause of the overflow is an incorrect double call by the UEFI firmware to the GetVariable service when the TCG2_CONFIGURATION value exceeds the originally allocated buffer size on the stack, where both calls use the same variable with data_size without changing it after the first call. If an attacker is able to change the value of the UEFI variable TCG2_CONFIGURATION during system operation, they can set it large enough for the first call to return EFI_BUFFER_TOO_SMALL. Since after the first call, the data_size value, instead of the originally allocated buffer size, will be set to the value of the TCG2_CONFIGURATION variable, the second call will result in a buffer overflow.
void Function_0000537c(void){
…
ulonglong data_size;
char buffer [8];
…
EVar1 = (*gRS_2->GetVariable)
((CHAR16 *)TCG2_CONFIGURATION, &gTCG2_CONFIG_FORM_SET_GUID,
(UINT32 *)0x0, &data_size, buffer);
if (EVar1 == EFI_BUFFER_TOO_SMALL) {
EVar1 = (*gRS_2->GetVariable)
((CHAR16 *)TCG2_CONFIGURATION,&gTCG2_CONFIG_FORM_SET_GUID,
(UINT32 *)0x0,&data_size,buffer)
The issue is observed in the Phoenix SecureCore firmware used on devices with Intel processors from the AlderLake, CoffeeLake, CometLake, IceLake, JasperLake, KabyLake, MeteorLake, RaptorLake, RocketLake, and TigerLake families. The ability to execute an attack on a specific system depends on the firmware settings and access to the TCG2_CONFIGURATION variable. An example of the vulnerability exploitation was demonstrated on Lenovo ThinkPad X1 Carbon Gen laptops and Lenovo ThinkPad X1 Yoga 4th Gen laptops. The vulnerability has been addressed in firmware updates from Technologies and Lenovo released in April and May.
Source: opennet.ru
