An attacker with local privileged access can exploit this vulnerability to elevate privileges from ring 3 or ring 0 (depends on the operating system) to a DXE driver and execute arbitrary code. A malicious code installed as a result of the vulnerability exploitation in a DXE driver could survive across an operating system (OS) boot process and runtime or modify NVRAM area on SPI flash storage (to gain persistence on target platform). Additionally, this vulnerability potentially could be used by threat actors to bypass OS security mechanisms (modify privileged memory or runtime variables), influence on the OS boot process, and in some cases would allow an attacker to hook or modify EFI Runtime services.
This vulnerability was detected by the Deep Vulnerability Analysis (DVA) component from Binarly Platform
The pseudocode of the vulnerable function is shown below:
EFI_STATUS sub_1AC8()
{
UINTN DataSize;
char Data;
Data = 0;
DataSize = 1;
if ( (gPassed & 1) == 0 )
{
gPassed = 1;
if ( !gRT->GetVariable(L"PrintChargerAppDbgMsg", &QCOM_TOKEN_SPACE_GUID, 0, &DataSize, &Data) )
gPrintChargerAppDbgMsg = Data != 0;
if ( !gRT->GetVariable(L"ChargerPDLogLevel", &QCOM_TOKEN_SPACE_GUID, 0, &DataSize, &Data) )
gChargerPDLogLevel = Data;
if ( !gRT->GetVariable(L"ChargerPDLogTimer", &QCOM_TOKEN_SPACE_GUID, 0, &DataSize, &Data) )
{
gChargerPDLogTimer = Data;
gChargerPDLogTimerTrue = Data != 0;
}
}
return EFI_SUCCESS;
}As we can see from the pseudocode, DataSize is initialized only once (before the first call to gRT->GetVariable()).
Thus, if the data size of the variable in NVRAM is greater than 1, DataSize will be overwritten. Thus, a next call to gRT-GetVariable() may cause an overflow on the stack (and subsequent execution of arbitrary code).
In order to fix this vulnerability, the DataSize variable must be initialized before each call to gRT->GetVariable().
This vulnerability is subject to a 90 day disclosure deadline. After 90 days elapsed or a patch has been made broadly available (whichever is earlier), the vulnerability report will become visible to the public.
BINARLY efiXplorer team
.png)
