Abstract
On 20th-June-2024 Eclypsium published an article on UEFI vulnerability that affected motherboards that were developed for Intel CPUs. Eclypsiums binary analysis system found this vulnerability while testing Lenovo ThinkPad X1 Carbon 7th Gen and X1 Yoga 4th Gen, both using the latest Lenovo BIOS updates. This vulnerability alows attacker to install bootkit and create a backdoor that cannot be closed. It is imposible to delete the bootkit, even if you try to reinstall OS, install new processor. This bootkit is installed on the BIOS (UEFI) chip present on the motherboard. Difference between RootKit and BootKit is that rootkit usually targets the system kernel, bootkit instead targets the MBR (Master Boot Record) or VBR (Volume Boot Record) embedding itself deeper than traditional rootkits.
Impact of the vulnerability (CVE-2024-0762 with a reported CVSS of 7.5)
What is UEFI?
UEFI (Unified Extensible Firmware Interface) is the successor of BIOS (Basic Input/Output System). BIOS helps you verify system integrity before the bootloader is invoked and the OS in initialized. UEFI takes one step further, everything in the digital world is based on trust transactions, communication, distribution of information where does this trust originate from. There needs to be a trust factor that is impossible to repudiate, is always available, and is confidential. All these features can be provided by UEFI, UEFI helps check the OS integrity, establish trust, maintain confidentiality and availability through measured boot, secure boot, trusted boot and TPM (Trusted Platform Module).
What is Trusted Platform Module (TPM), you may ask
Trusted Platform Module (TPM), is a dedicated hardware on your motherboard that is fully dedicated for establishing trust, creating cryptographic keys, storing them, random-value generator, storing certificates that are burned into them during the production from OEM. As the name suggests they are the trust source of the internet, each motherboard that uses UEFI has a TPM.
The UEFI uses TPM in conjuction with measured boot, secure boot, trusted boot to verify an OS and its bootloader before it is started.
Firmware issues
This is another example of supply chain vulnerability, the manufacturer of motherboards out source the UEFI firmware from Phoenix Technologies (3rd party developer). Developing UEFI firmware is such a niche that only small number of people are developing it. These firmwares are responsible to guide UEFI on how to use TPM and its sister services to verify an OS and its bootloader.
What happens when the firmware itself is vulnerable the UEFI services cannot be used properly to its full potential. Producing a vulnerability at the -2 Ring Level as the vulnerability originates at the base of the trust. The firmware has a classic bufferoverflow vulnerability, the code attached below depicts that the in the following function a variable is being called and has a set amount of assigned memory to it and a specific data size, but if the variable overflows the functions detects the overflow and recalls the variable iteratively without reintializing the data size eventually leading to memory bufferoverflow, that can be used to inject bootkit and install backdoors at the very base of the trust.
The affected platforms are intel CPU based platforms. To elaborate following is the list of intel platforms vulnerable to these vulnerabilities AlderLake, CoffeeLake, CometLake, IceLake, JasperLake, KabyLake, MeteorLake, RaptorLake, RocketLake, and TigerLake.
Mitigations
[1] The only solution is to update the firmware, a new update has been released fixing this vulnerability. Updating firmware is a complex process as a mistake can brick the computer.
[2] Temporarily switch to AMD based platforms and update to the newest generation of Intel processor.
[3] For affected OEMs, closely develop solutions in colaboration with their 3rd party providers to make the process as secure as possible.