Firmware flaws could allow a malicious reflash, US CERT warns

U.S. CERT warned of three issues that could affect critical firmware

Three vendors have released fixes for vulnerabilities found in the critical firmware used during a computer's startup, according to an advisory from the U.S. Computer Emergency Readiness Team.

The vulnerabilities could allow an attacker to bypass a feature called Secure Boot, which verifies that firmware components carry a correct digital signature ensuring the software's authenticity. The attacker could then replace the device's firmware.

The flaws lie within some UEFI (unified extensible firmware interface) systems, the advisory said. UEFI is a firmware interface that was designed to improve upon BIOS.

A boot script within the UEFI S3 Resume path "resides in unprotected memory which can be tampered with by an attacker with access to physical memory," the advisory said.

An authenticated local attacker could bypass Secure Boot and reflash, or replace, the firmware even if signed firmware updates are supposed to be used. An attack could also cause a system to be inoperable.

Several vendors have taken action. American Megatrends Incorporated (AMI), which makes BIOS and UEFI firmware, has "addressed the issue on a generic basis and is working with OEMs to implement fixes for projects in the field and production."

Intel and Phoenix Technologies, which also makes UEFI software, have issued fixes, the advisory said.

The advisory was one of three issued by U.S. CERT on Monday. The agency also warned of a "race condition" vulnerability in some Intel chipsets that could allow the bypass of a BIOS locking mechanism, allowing malicious code to be inserted into firmware.

American Megatrends and Phoenix Technologies have issued updates to address the issue, but it's unknown if other major vendors may be affected, according to the advisory.

U.S. CERT also warned in a third advisory of a buffer overflow in the open-source EDK1 project's UEFI reference implementation. One affected vendor that uses the firmware, Insyde Software, has fixed the issue.

American Megatrends, Apple, IBM, Intel and Phoenix Technologies are not affected by that flaw. However, it's not known whether other large vendors may be vulnerable.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags AppleintelIBMPhoenix TechnologiesExploits / vulnerabilitiesU.S. Computer Emergency Readiness TeamAmerican MegatrendsInsyde Software

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?