Dozens of Security Flaws Discovered in UEFI Firmware Used by Several Vendors

As many as 23 new high severity security vulnerabilities have
been disclosed in different implementations of Unified Extensible
Firmware Interface (UEFI^[1]) firmware used by
numerous vendors, including Bull Atos, Fujitsu, HP, Juniper
Networks, Lenovo, among others.

The vulnerabilities reside in Insyde Software’s InsydeH2O UEFI
firmware, according to enterprise firmware security company
Binarly^[2], with a majority of the
anomalies diagnosed in the System Management Mode (SMM^[3]).

UEFI is a software specification that provides a standard
programming interface connecting a computer’s firmware to its
operating system during the booting process. In x86 systems, the
UEFI firmware is usually stored in the flash memory chip of the
motherboard.

“By exploiting these vulnerabilities, attackers can successfully
install malware that survives operating system re-installations and
allows the bypass of endpoint security solutions (EDR/AV), Secure Boot^[4], and
Virtualization-Based Security isolation,” the researchers said.

Successful exploitation of the flaws (CVSS scores: 7.5 – 8.2)
could allow a malicious actor to run arbitrary code with SMM
permissions, a special-purpose execution mode in x86-based
processors that handles power management, hardware configuration,
thermal monitoring, and other functions.

“SMM code executes in the highest privilege level and is
invisible to the OS, which makes it an attractive target for
malicious activity,” Microsoft notes^[5]
in its documentation, adding the SMM attack vector could be abused^[6]
by a piece of nefarious code to trick another code with higher
privileges into performing unauthorized activities.

Worse, the weaknesses can also be chained together to bypass
security features and install malware in a manner that survives
operating system re-installations and achieve long-term persistence
on compromised systems — as observed in the case of MoonBounce^[7]
— while stealthily creating a communications channel to exfiltrate
sensitive data.

Insyde has released firmware
patches^[8] that address these
shortcomings as part of the coordinated
disclosure^[9] process. But the fact
that the software is used in several OEM implementations means it
could take a considerable amount of time before the fixes actually
trickle down to affected devices.