Hundreds of PC and server models that use Intel processors could be affected by a high-severity vulnerability found recently in Phoenix Technologies’ SecureCore UEFI firmware solution.
The vulnerability, tracked as CVE-2024-0762 and dubbed UEFIcanhazbufferoverflow, was discovered by an automated analysis system developed by enterprise firmware and hardware security firm Eclypsium.
The security hole can be exploited by a local attacker to escalate privileges and execute arbitrary code within the UEFI firmware during runtime.
Eclypsium warned that this is a type of vulnerability that may be leveraged by threats such as the Black Lotus UEFI rootkit.
“This vulnerability exemplifies two characteristic traits of IT infrastructure supply chain incidents—high impact and broad reach. UEFI firmware is some of the most high-value code on modern devices, and any compromise of that code can give attackers full control and persistence on the device,” Eclypsium noted.
An investigation showed that the vulnerability is related to an unsafe variable in the Trusted Platform Module (TPM) configuration. The vulnerable SecureCore UEFI firmware runs on multiple Intel mobile, desktop and server processors used by computer makers such as Lenovo, Acer, Dell and HP.
Phoenix Technologies addressed the vulnerability in an advisory published in May, confirming that the SecureCore firmware running on Intel processor families such as Alder Lake, Coffee Lake, Comet Lake, Ice Lake, Jasper Lake, Kaby Lake, Meteor Lake, Raptor Lake, Rocket Lake, and Tiger Lake are impacted.
Phoenix has patched CVE-2024-0762 and device manufacturers have started deploying the patch to their products.
Lenovo informed customers about the vulnerability in an advisory published in May. The company has started releasing patches, and for some computers fixes are expected to become available later this summer.
Related: Most Linux Systems Exposed to Complete Compromise via Shim Vulnerability
Related: New AMI BMC Flaws Allowing Takeover and Physical Damage Could Impact Millions of Devices
Related: Gigabyte Rolls Out BIOS Updates to Remove Backdoor From Motherboards
