New Flaw in Acer Laptops Could Let Attackers Disable Secure Boot Protection

Acer has released a firmware update to address a security
vulnerability that could be potentially weaponized to turn off UEFI
Secure Boot on affected machines.

Tracked as CVE-2022-4020^[1], the high-severity
vulnerability affects five different models that consist of Aspire
A315-22, A115-21, and A315-22G, and Extensa EX215-21 and
EX215-21G.

The PC maker described the vulnerability as an issue that “may
allow changes to Secure Boot settings by creating NVRAM variables.”
Credited with discovering^[2]
the flaw is ESET researcher Martin Smolár, who previously disclosed
similar bugs^[3]
in Lenovo computers.

Disabling Secure Boot, an integrity mechanism that guarantees
that only trusted software is loaded during system startup, enables
a malicious actor to tamper with boot loaders^[4], leading to severe
consequences.

This includes granting^[5]
the attacker complete control over the operating system loading
process as well as “disable or bypass protections to silently
deploy their own payloads with the system privileges.”

Per the Slovak cybersecurity company, the flaw resides in a
DXE driver^[6]
called HQSwSmiDxe.

The BIOS update is expected to be released as part of a critical
Windows update. Alternatively, users can download the fixes from
Acer’s Support portal^[7].