Phoenix SecureCore UEFI-firmwares, which are used in many laptops, PCs, and servers with Intel processors, have a vulnerability (CVE-2024-0762) that allows for code execution at the firmware level if system access is obtained. This vulnerability can be exploited after successfully attacking the system to insert a backdoor in the firmware that operates under the operating system, bypasses OS security mechanisms, remains undetectable by malware detection programs, and retains its presence even after the OS is reinstalled.
The vulnerability is caused by unsafe usage of the TCG2_CONFIGURATION variable in the TPM (Trusted Platform Module) configuration, manipulation of which can lead to buffer overflow and potential code execution with UEFI firmware privileges, i.e., at the SMM (System Management Mode) level, which has higher priority than the hypervisor mode and ring 0 protection, providing unrestricted access to all system memory. The vulnerability is present in the TPM configuration handling code in UEFI and manifests regardless of the presence of a TPM chip.
The cause of the resulting overflow is an incorrect double call to the UEFI service GetVariable by the firmware if the value of TCG2_CONFIGURATION exceeds the initially allocated size of the stack buffer, with both calls using the same variable with the size of data_size without changing it after the first call. If an attacker can change the value of the UEFI variable TCG2_CONFIGURATION during system operation, they can set it large enough for the first call to return EFI_BUFFER_TOO_SMALL. Since after the first call the value of data_size will be set to the size of the TCG2_CONFIGURATION variable instead of the initially specified buffer size, the second call will lead to a buffer overflow.
void Function_0000537c(void){
…
ulonglong data_size;
char buffer [8];
…
EVar1 = (*gRS_2->GetVariable)
((CHAR16 *)TCG2_CONFIGURATION, &gTCG2_CONFIG_FORM_SET_GUID,
(UINT32 *)0x0, &data_size, buffer);
if (EVar1 == EFI_BUFFER_TOO_SMALL) {
EVar1 = (*gRS_2->GetVariable)
((CHAR16 *)TCG2_CONFIGURATION,&gTCG2_CONFIG_FORM_SET_GUID,
(UINT32 *)0x0,&data_size,buffer)
Probleem ilmneb Phoenix SecureCore püsivara puhul, mida kasutatakse AlderLake, CoffeeLake, CometLake, IceLake, JasperLake, KabyLake, MeteorLake, RaptorLake, RocketLake ja TigerLake protsessoritega seadmetes. Rünnaku võimalus konkreetsele süsteemile sõltub püsivara seadetest ja juurdepääsu saamisest TCG2_CONFIGURATION muutuja juurde. Rünnaku näide on demonstreeritud Lenovo ThinkPad X1 Carbon Gen ja Lenovo ThinkPad X1 Yoga 4. põlvkonna sülearvutites. Haavatavust on parandatud aprilli ja mai püsivara uuendustes Technologies ja Lenovo poolt.
Allikas: opennet.ru
