Overview
Some UEFI systems fail to properly restrict access to the boot script used by the EFI S3 Resume Boot Path, allowing an authenticated, local attacker to bypass various firmware write protections.
Description
According to Rafal Wojtczuk of Bromium and Corey Kallenberg of The MITRE Corporation: "During the UEFI S3 Resume path, a boot script is interpreted to re-initialize the platform. The boot script dictates various memory and port read/write operations to facilitate this re-initialization. The boot script is interpreted early enough where important platform security mechanisms have not yet been configured. For example, BIOS_CNTL, which helps protects the platform firmware against arbitrary writes, is unlocked. TSEGMB, which protects SMRAM against DMA, is also unlocked. |
Impact
An authenticated local attacker may be able to bypass Secure Boot and/or perform an arbitrary reflash of the platform firmware despite the presence of signed firmware update enforcement. Additionally, the attacker could arbitrarily read or write to the SMRAM region. Lastly, the attacker could corrupt the platform firmware and cause the system to become inoperable. |
Solution
Please see the Vendor Information section below to determine if your system may be affected. We are continuing to communicate with vendors as they investigate these vulnerabilities. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 6.2 | AV:L/AC:H/Au:N/C:C/I:C/A:C |
| Temporal | 5.6 | E:POC/RL:ND/RC:C |
| Environmental | 5.6 | CDP:ND/TD:H/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to Rafal Wojtczuk and Corey Kallenberg for reporting this vulnerability, as well as Intel Advanced Threat Research.
This document was written by Todd Lewellen.
Other Information
| CVE IDs: | CVE-2014-8274 |
| Date Public: | 2014-12-28 |
| Date First Published: | 2015-01-05 |
| Date Last Updated: | 2015-08-03 14:39 UTC |
| Document Revision: | 32 |