[BRLY-2022-035] Stack memory leak vulnerability in DXE driver.

Summary

Binarly REsearch Team has discovered a stack memory leak vulnerability that allows a potential attacker to write stack memory to NVRAM variable.

Vulnerability Information

• BINARLY internal vulnerability identifier: BRLY-2022-035
• Lenovo PSIRT assigned CVE identifier: CVE-2022-4434
• CVSS v3.1 Score 6.0 Medium AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Affected Lenovo firmwares with confirmed impact by Binarly REsearch Team

Potential impact

An attacker with local privileged access can exploit this vulnerability to read the contents of the stack and use this information to exploit other vulnerabilities in DXE. A malicious code installed as a result of the vulnerability exploitation in a DXE driver could survive across an operating system (OS) boot process and runtime or modify NVRAM area on SPI flash storage (to gain persistence on target platform).Additionally, this vulnerability potentially could be used by threat actors to bypass OS security mechanisms (modify privileged memory or runtime variables), influence on the OS boot process, and in some cases would allow an attacker to hook or modify EFI Runtime services.

Vulnerability description

The pseudocode of the vulnerable function is shown below:

unsigned sub_2B18()
{
  // ...
  DataSize = 8;
  if ( (gRT->GetVariable(L"PwdUnlockErr", &gVariableGuid, 0, &DataSize, Value) & 0x8000000000000000) != 0 )
    v10 = 1;
  else
    v10 = *(v6 + 1);
  SetVariable = gRT->SetVariable;
  Value[0] = v10;
  SetVariable(L"PwdUnlockErr", &gVariableGuid, VARIABLE_ATTRIBUTE_NV_BS_RT, DataSize, Value);
  // ...
}

As we can see from the pseudocode, the gRT->SetVariable() service is called with the DataSize value, which can be overwritten inside the gRT->GetVariable() service.

Thus, a potential attacker can write X - 8 bytes from the stack to NVRAM if writes any buffer of length X > 8 to the PwdUnlockErr NVRAM variable.

In order to fix this vulnerability, the DataSize variable must be initialized before gRT->SetVariable():

  // ...
  DataSize = 8;
  if ( (gRT->GetVariable(L"PwdUnlockErr", &gVariableGuid, 0, &DataSize, Value) & 0x8000000000000000) != 0 )
    v10 = 1;
  else
    v10 = *(v6 + 1);
  SetVariable = gRT->SetVariable;
  Value[0] = v10;

  DataSize = 8; // <--- added
  SetVariable(L"PwdUnlockErr", &gVariableGuid, VARIABLE_ATTRIBUTE_NV_BS_RT, DataSize, Value);
  // ...

Disclosure timeline

This vulnerability is subject to a 90 day disclosure deadline. After 90 days elapsed or a patch has been made broadly available (whichever is earlier), the vulnerability report will become visible to the public.

Acknowledgements

Binarly REsearch Team