Security experts from the Binarly company have just discovered more than twenty vulnerabilities in the UEFI (Unified Extensible Firmware Interface) of PCs. Among the computer manufacturers concerned, there are Acer, Microsoft, Dell and HP.
Binarly researchers have obviously uncovered a problem that is likely to affect a very large number of PCs across the planet. According to them, UEFI InsydeH2O firmware is affected by 23 security flaws. However, this firmware is used by most computer and motherboard manufacturers.
Thus, the following manufacturers are potentially affected by the security vulnerabilities in question, some having even already confirmed the presence of security vulnerabilities in the hardware:
- Acer
- AMD
- ASUS
- Dell
- Fujitsu
- HP
- Intel
- Lenovo
- Microsoft
- Siemens
More than twenty security flaws discovered in the UEFI of PCs
UEFI is this interface now present on all motherboards and which allows you to control the components of your PC, manage the power supply, specify the boot order of the units, etc. For the past fifteen years, UEFI has tended to replace the BIOS, the death of which was announced by Intel in 2017.
UEFI is vital to the proper functioning of your computer and intervenes upstream of the operating system. According to Binarly, 23 security vulnerabilities have been discovered in the InsydeH2O firmware, which is designed by the Insyde company, one of the leading UEFI firmware and board controller vendors.
Most of these flaws relate to UEFI’s System Management Mode (SMM), a hardware and power management mode that has elevated privileges. According to Binarly, 10 of the flaws can be exploited as part ofan escalation attack, while 12 of the discovered vulnerabilities are capable of corrupting memory. A final flaw concerns the management of the Driver eXecution Environment (DXE).
An attacker who successfully exploited a flaw in the SMM could then disable security options initiated at PC startup such as SecureBoot or IntelBootGuard. He would also have the possibility ofinstall malware that is nearly impossible to removeor of create a backdoor and steal personal data.
Also read: how to access the BIOS or UEFI of the PC
How to check that the UEFI of your PC is not affected by a security breach?
Insyde, Fujitsu and Intel have already confirmed that their hardware was indeed affected by the various vulnerabilities. Manufacturers Rockwell, Supermicro and Toshiba ensure that they are not affected by these UEFI security flaws. Yes Insyde has already updated its firmwares, we will have to wait for each manufacturer to take them into consideration for their PCs. This can take a long time, not to mention that some hardware is now obsolete and the update will probably not be supported by their manufacturer.
Binarly provides a small tool called FwHunt to analyze the UEFI firmware of your PC. This is a small python script downloadable from Github. Take care to get the one that matches your PC manufacturer and run the appropriate command, as in the example below.
Source: Binarly