{"id":105273,"date":"2022-10-10T09:36:38","date_gmt":"2022-10-10T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/intel-podtverdil-podlinnost-utechki-koda-uefi-proshivok-dlya-chipov-alder-lake"},"modified":"2022-10-10T09:36:38","modified_gmt":"2022-10-10T07:36:38","slug":"intel-podtverdil-podlinnost-utechki-koda-uefi-proshivok-dlya-chipov-alder-lake","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/intel-podtverdil-podlinnost-utechki-koda-uefi-proshivok-dlya-chipov-alder-lake","title":{"rendered":"Intel has confirmed the authenticity of the leak of UEFI firmware code for Alder Lake chips.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Intel has confirmed the authenticity of the UEFI firmware and BIOS source codes published by an unknown source on GitHub. A total of 5.8 GB of code, utilities, documentation, blobs, and settings related to firmware creation for systems with processors based on the Alder Lake microarchitecture, released in November 2021, were published. The most recent update to the published code is dated September 30, 2022. <\/p>\n
According to Intel, the leak occurred due to a third party and not as a result of a compromise of the company's infrastructure. It is also mentioned that the publicly accessible code includes the Project Circuit Breaker program, which offers rewards ranging from $500 to $100,000 for identifying security issues in Intel's firmware and products (implying that researchers may receive rewards for reporting vulnerabilities discovered using the leaked content). <\/p>\n
It is not specified who exactly was the source of the leak (OEM manufacturers had access to the tools for building firmware and companies that develop custom firmware). An analysis of the contents of the published archive revealed some product-specific tests and services from Lenovo (such as 'Lenovo Feature Tag Test Information', 'Lenovo String Service', 'Lenovo Secure Suite', 'Lenovo Cloud Service'), but Lenovo's involvement in the leak has not yet been confirmed. The archive also included utilities and libraries from Insyde Software, which develops firmware for OEM manufacturers, and the git log contains the email of an employee from LC Future Center, a company that produces laptops for various OEM manufacturers. Both companies cooperate with Lenovo. <\/p>\n
According to Intel, the leaked code does not contain any confidential data or components that could lead to the disclosure of new vulnerabilities. However, Mark Ermolov, who specializes in researching Intel platform security, identified undocumented MSR (Model Specific Registers) information in the published archive, which is used for microcode control, tracing, and debugging. This information falls under a non-disclosure agreement. Moreover, the archive includes a private key used for signing firmware digitally, which could potentially be exploited to bypass Intel Boot Guard (the effectiveness of the key is unverified, and it may be a test key). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"