Stack buffer overflow vulnerability leads to arbitrary code execution in a DXE driver on Intel platform.
BINARLY efiXplorer team has discovered a stack overflow vulnerability that allows a local root user to access a UEFI DXE driver and execute arbitrary code.
Image preview
Potential Impact
An attacker with local privileged access can exploit this vulnerability to elevate privileges from ring 3 or ring 0 (depends on the operating system) to a DXE driver and execute arbitrary code. Malicious code installed as a result of this exploitation could survive operating system (OS) boot process and runtime, or modify NVRAM area on the SPI flash storage (to gain persistence). Additionally, threat actors could use this vulnerability to bypass OS security mechanisms (modify privileged memory or runtime variables), influence OS boot process, and in some cases allow an attacker to hook or modify EFI Runtime services.
Image preview
Vulnerability Information
- BINARLY internal vulnerability identifier: BRLY-2022-038
- Intel PSIRT assigned CVE identifier: CVE-2023-22449
- Intel advisory: INTEL-SA-00917
- CVSS v3.1: 8.2 High AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Image preview
Affected Intel firmware confirmed to be impacted by Binarly team
| Device/Firmware | File Name | SHA256 (File PE32 section) | File GUID |
|---|---|---|---|
Intel NUC M15 / BCTGL357 v0077 (Latest) | Setup | 3899216b9855aef3687f707e1b9e20a9843966c3e3b42af0e0ecd51617418a22 | 899407D7-99FE-43D8-9A21-79EC328CAC21 |
Image preview
Vulnerability description
The vulnerability exists in the function located at offset 0x109A0.
The pseudocode for this function is shown below:
_BYTE *__fastcall HandleTpm12VersionInfoAndPCRBitmap(void *a1)
{
...
char Value[20];
EFI_GUID VendorGuid;
UINTN DataSize;
UINT32 SetupAttributes;
UINTN DataSize;
char Buffer[128];
char SetupValue[4787];
UINT32 Attributes;
DataSize = 20;
Attributes = 0;
SetupDataSize = 0x12B3;
VendorGuid.Data1 = 0xEC87D643;
*&VendorGuid.Data2 = 0x4BB5EBA4;
*VendorGuid.Data4 = 0x3E3FE5A1;
*&VendorGuid.Data4[4] = 0xA90DB236;
Res = gRT->GetVariable(L"Setup", &VendorGuid, &SetupAttributes, &SetupDataSize, SetupValue);
if ( Res >= 0 )
{
if ( gEfiHiiStringProtocol
|| (Res = gBS->LocateProtocol(&EFI_HII_STRING_PROTOCOL_GUID, 0, &gEfiHiiStringProtocol), Res >= 0) )
{
Res = sub_1073C(a1);
if ( Res )
{
if ( !SetupValue[21] && !SetupValue[17] )
{
...
if (gRT->GetVariable(L"Tpm12VersionInfo", &PEI_TCG_INTERNAL_FLAGS_GUID, &Attributes, &DataSize, Value) == EFI_SUCCESS)
{
...
}
}
Res = gRT->GetVariable(L"PCRBitmap", &PEI_TCG_INTERNAL_FLAGS_GUID, &Attributes, &DataSize, Value);
if ( Res >= 0 )
{
...
}
}
}
}
return Res;
}
Consider the following code snippet:
DataSize = 20;
...
...
...
...
{
...
if (gRT->GetVariable(L"Tpm12VersionInfo", &PEI_TCG_INTERNAL_FLAGS_GUID, &Attributes, &DataSize, Value) == EFI_SUCCESS)
{
...
}
}
Res = gRT->GetVariable(L"PCRBitmap", &PEI_TCG_INTERNAL_FLAGS_GUID, &Attributes, &DataSize, Value);
...
An attacker can change the values of the Tpm12VersionInfo and PCRBitmap variables.
If the size of the value of the Tpm12VersionInfo variable is greater than 20, then after the first call to the GetVariable service, the DataSize variable will be overwritten (this means that the attacker is in control of the DataSize variable).
The second call to GetVariable (for the PCRBitmap variable) can lead to a stack overflow and arbitrary code execution.
Image preview
Disclosure timeline
This vulnerability is subject to a 90 day disclosure deadline. After 90 days elapsed or a patch has been made broadly available (whichever is earlier), the vulnerability report will become visible to the public.
| Disclosure Activity | Date (YYYY-MM-dd) |
|---|---|
Intel PSIRT is notified | 2022-12-19 |
Intel PSIRT assigned CVE number | 2023-02-28 |
Intel PSIRT provide patch release | 2023-08-08 |
BINARLY public disclosure date | 2023-11-16 |
Image preview
Acknowledgements
Image preview
See if you are impacted now with our Firmware Vulnerability Scanner
Find Vulnerabilities, Generate SBOMs & CBOMs