.webp)
n/a
The Boot Guard hardening technology in the firmware of affected devices cannot be trusted because the private RSA key for the Key Manifest and Boot Policy Manifest has been leaked. This means that an attacker with write access to the SPI flash storage (e.g. by physical access or by exploiting a BIOS write protection bypass vulnerability) could install a persistent backdoor/implant.
BINARLY REsearch team has received information that Clevo firmware update packages are being distributed with private keys for Boot Guard: https://github.com/binarly-io/SupplyChainAttacks/issues/6. The Binarly REsearch team checked an internal dataset of firmware images for the use of leaked keys across different vendors and discovered several affected devices, some of which had received updates only a few months ago.
The Boot Guard hardening technology in the firmware of affected devices cannot be trusted because the private RSA key for the Key Manifest and Boot Policy Manifest has been leaked. This means that an attacker with write access to the SPI flash storage (e.g. by physical access or by exploiting a BIOS write protection bypass vulnerability) could install a persistent backdoor/implant.
Thierry Laurion created the following issue in the binarly-io/SupplyChainAttacks repository: https://github.com/binarly-io/SupplyChainAttacks/issues/6. He referred to the discovery published in Win-Raid forum about Boot Guard private keys being leaked in Clevo firmware update packages.
The Binarly REsearch team has confirmed that the BootGuardKey.exe binary from the update packages contains private keys for the Key Manifest and Boot Policy Manifest.
Below are the leaked private key modules for KM and BPM as well as the UEFITool log for affected firmware:
# RSA modules extracted from leaked private keys:
$ openssl rsa -in km.pem -noout -modulus | cut -d'=' -f2 | fold -w2 | tac | tr -d '\n'
211D274F08BD768497FB377F0EA739F6CC0852B0899FA2327BD1AE174F38342DE8B57AFE88D80ECA82D51B2CDBEA9AFA5D9328B00C651B2F58F523CD9C16ED35642653182E705287F83D1DB3130E42B4C6E624CD898E4615B40ECF7024907EDA8B292450C6858A9C8DAD07E9DBD39CE4624C9DAF35C6A880359DFFA757C6DCD8E4AB53EF638228D31A0BF6CFB3F527EAB3F268699E66F6022900C35826E7E1BF8433BC91F77D2B1215FD20002FF80480A1B93E69E712BDACF84AE41FE993ABE2890272A4232B116992D1BBED25DD721F231C49942F6304BC3C08E7A9924D5F00A137F7F94984E6EFD88F12169F57A80DB5877B4782490F8CB478B5A81195616EE6EBE8E70E09092DFE3AA91E21052DA76536B6EF61CF9C881AC71442A9D174ACFA4588AA7CCE4AEE333B67D47DE7CD4EE8E4D53FC2D387ADBBA0E238180DE80D1AF1CD8609BA89547FB96808971E4B34B1C832EBEA12A75797E49563D61A5895CA14FA6B6925AEE8DC44F6730CF102CF1001A21CF31AA4386C5569D9148181C5
$ openssl rsa -in bpm.pem -noout -modulus | cut -d'=' -f2 | fold -w2 | tac | tr -d '\n'
5B170A51CF8A4C832E5C7F5D9EC8F1DE48975423E4C00EFE53875D23A3565AAAAE14057BA0ED9242EC466BA5C533C17CAD9366350A2A3C1B9AFE5AECA0BBA8B4396226EB0978C0DFF3EAA423C400C16477B7C9D7EDFFFEBF1BF91A6E1C10501CBFB0AF98EEFE69E10385D8FD4902113C8B6BB9579C28363EDD12C100A3579741BC5115242F45989B0955455051D84F558D6A3579FDB27D84BAC4D84CDC0E61054E36A66D9ED1D434A5C76A1413595445E81275D2D526455A60D5F819796A67D3CFF1794CE7763D2E9103BDEF048816B8E59F46EC03BCBCAA728ABA0B61E5561A5769B18AB266B8DAF48D6F3766EE2D98BF6831A8A8AC0671D168B2A8130BDBE3
# RSA public keys used for the Boot Guard verification chain:
$ UEFITool V15xRNX.BIN
Intel BootGuard Key manifest found at base 11E1DB0h
...
Key Manifest Public Key Exponent: 10001h
Key Manifest Public Key:
211D274F08BD768497FB377F0EA739F6CC0852B0899FA2327BD1AE174F38342D
E8B57AFE88D80ECA82D51B2CDBEA9AFA5D9328B00C651B2F58F523CD9C16ED35
642653182E705287F83D1DB3130E42B4C6E624CD898E4615B40ECF7024907EDA
8B292450C6858A9C8DAD07E9DBD39CE4624C9DAF35C6A880359DFFA757C6DCD8
E4AB53EF638228D31A0BF6CFB3F527EAB3F268699E66F6022900C35826E7E1BF
8433BC91F77D2B1215FD20002FF80480A1B93E69E712BDACF84AE41FE993ABE2
890272A4232B116992D1BBED25DD721F231C49942F6304BC3C08E7A9924D5F00
A137F7F94984E6EFD88F12169F57A80DB5877B4782490F8CB478B5A81195616E
E6EBE8E70E09092DFE3AA91E21052DA76536B6EF61CF9C881AC71442A9D174AC
FA4588AA7CCE4AEE333B67D47DE7CD4EE8E4D53FC2D387ADBBA0E238180DE80D
1AF1CD8609BA89547FB96808971E4B34B1C832EBEA12A75797E49563D61A5895
CA14FA6B6925AEE8DC44F6730CF102CF1001A21CF31AA4386C5569D9148181C5
...
Intel BootGuard Boot Policy Manifest found at base 11E21B0h
...
Boot Policy Public Key Exponent: 10001h
Boot Policy Public Key:
5B170A51CF8A4C832E5C7F5D9EC8F1DE48975423E4C00EFE53875D23A3565AAA
AE14057BA0ED9242EC466BA5C533C17CAD9366350A2A3C1B9AFE5AECA0BBA8B4
396226EB0978C0DFF3EAA423C400C16477B7C9D7EDFFFEBF1BF91A6E1C10501C
BFB0AF98EEFE69E10385D8FD4902113C8B6BB9579C28363EDD12C100A3579741
BC5115242F45989B0955455051D84F558D6A3579FDB27D84BAC4D84CDC0E6105
4E36A66D9ED1D434A5C76A1413595445E81275D2D526455A60D5F819796A67D3
CFF1794CE7763D2E9103BDEF048816B8E59F46EC03BCBCAA728ABA0B61E5561A
5769B18AB266B8DAF48D6F3766EE2D98BF6831A8A8AC0671D168B2A8130BDBE3
...
As we can see, the leaked private key modules match the public key modules used in the KM and BPM structures in the affected firmware.
