A Phoenix SecureCore UEFI firmware, used in many laptops, PCs, and servers with Intel processors, has a vulnerability (CVE-2024-0762) that allows code execution at the firmware level if system access is achieved. This vulnerability can be exploited after a successful system attack to install a backdoor in the firmware that operates under the operating system, bypassing the OS security mechanisms, remaining undetected by malware detection programs, and preserving its presence after OS reinstallation.
The vulnerability is caused by unsafe usage of the TCG2_CONFIGURATION variable in the TPM (Trusted Platform Module) configuration, manipulation of which can lead to a buffer overflow and potential code execution with UEFI firmware privileges, i.e., at the SMM (System Management Mode) level, which is more privileged than the hypervisor mode and ring zero protection, providing unrestricted access to all system memory. The vulnerability exists in the TPM configuration handling code in UEFI and manifests regardless of the presence of a TPM chip.
The cause of the buffer overflow is an incorrect double call of the UEFI service GetVariable if the TCG2_CONFIGURATION value exceeds the originally allocated size in the buffer stack; both calls use the same variable with a data_size value without modification after the first call. If an attacker can change the UEFI variable TCG2_CONFIGURATION value during system operation, they can set it large enough so that the first call returns EFI_BUFFER_TOO_SMALL. Since after the first call the data_size value will be set to the size of the TCG2_CONFIGURATION variable instead of the initially specified buffer size, the second call will result in a buffer overflow.
void Function_0000537c(void){
…
ulonglong data_size;
char buffer [8];
…
EVar1 = (*gRS_2->GetVariable)
((CHAR16 *)TCG2_CONFIGURATION, &gTCG2_CONFIG_FORM_SET_GUID,
(UINT32 *)0x0, &data_size, buffer);
if (EVar1 == EFI_BUFFER_TOO_SMALL) {
EVar1 = (*gRS_2->GetVariable)
((CHAR16 *)TCG2_CONFIGURATION,&gTCG2_CONFIG_FORM_SET_GUID,
(UINT32 *)0x0,&data_size,buffer)
A probléma a Phoenix SecureCore firmware-ében nyilvánul meg, amelyet az AlderLake, CoffeeLake, CometLake, IceLake, JasperLake, KabyLake, MeteorLake, RaptorLake, RocketLake és TigerLake sorozatú Intel processzorokkal rendelkező eszközökön alkalmaznak. A támadás végrehajtásának lehetősége a firmware beállításaitól és a TCG2_CONFIGURATION változóhoz való hozzáférés lehetőségétől függ. A sérülékenység kihasználásának példáját a Lenovo ThinkPad X1 Carbon Gen és a Lenovo ThinkPad X1 Yoga 4. generációs laptopokon mutatták be. A sérülékenységet a Technologies és a Lenovo áprilisi és májusi firmware frissítései javítják.
Forrás: opennet.ru
