Sever security bug in Intel processors using Phoenix SecureCore

Topic

New Reply

https://www.cve.org/CVERecord?id=CVE-2024-0762

Potential buffer overflow when handling UEFI variables.

At least 10 generations of Intel processors affected.

Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel platforms This issue affects: Phoenix SecureCore™ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998; Phoenix SecureCore™ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562; Phoenix SecureCore™ for Intel Ice Lake: from 4.2.0.1 before 4.2.0.323; Phoenix SecureCore™ for Intel Comet Lake: from 4.2.1.1 before 4.2.1.287; Phoenix SecureCore™ for Intel Tiger Lake: from 4.3.0.1 before 4.3.0.236; Phoenix SecureCore™ for Intel Jasper Lake: from 4.3.1.1 before 4.3.1.184; Phoenix SecureCore™ for Intel Alder Lake: from 4.4.0.1 before 4.4.0.269; Phoenix SecureCore™ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218; Phoenix SecureCore™ for Intel Meteor Lake: from 4.5.1.1 before 4.5.1.15.

1 user thanked author for this post.

SueW

Reply | Quote

Replies

Important note: the issue is not what CPU you’re using, but what BIOS the motherboard manufacturer decided to use!

Phoenix SecureCode UEFI firmware bug

John Gallagher, vice president of Viakoo Labs, added that this most recent vulnerability is specific to one BIOS provider, Phoenix, and not AMI or Insyde, which are other major BIOS providers.

To find out what BIOS your PC is using, press WinKey+R, enter msinfo32.exe, and press Enter.

The BIOS provider, version and date will be in the right-hand column below the Processor info.

If it’s from Phoenix Technologies LTD and your CPU is a 6th — 14th gen Intel, your PC is most likely vulnerable and you should check with the manufacturer to see if there’s a BIOS update available that fixes it.

2 users thanked author for this post.

SueW, Alex5723

Reply | Quote

Important note 2.

This exploit requires a local attacker changing your UEFI (TPM configuration).
This is not an easy task and is unlikely to affect physically secure machines.

cheers, Paul

1 user thanked author for this post.

Alex5723

Reply | Quote

Paul T wrote:

This exploit requires a local attacker changing your UEFI (TPM configuration).

This can be done with a bogus BIOS update.

Reply | Quote