ESET researchers have discovered and analyzed three vulnerabilities affecting various Lenovo consumer laptop models. The exploitation of these vulnerabilities would allow attackers to deploy and successfully execute UEFI malware either in the form of SPI flash implant like LoJax or UEFI bootkit like the latest discovery ESPecter. ESET reported all discovered vulnerabilities to Lenovo in October 2021. Altogether, the list of affected devices contains more than one hundred different laptop models with millions of users worldwide.
“UEFI threats can be extremely stealthy and dangerous. They are executed early in the boot process, before transferring control to the operating system, which means that they can bypass almost all security measures and mitigations higher in the stack that could prevent their operating system payloads from being executed,” says ESET researcher Martin Smolár, who discovered the vulnerabilities. “Our discovery demonstrates that in some cases, deployment of the UEFI threats might not be as difficult as expected, and the larger amount of real-world UEFI threats discovered in the last years suggests that adversaries are aware of this,” he adds.
The first two of these vulnerabilities – CVE-2021-3971, CVE-2021-3972 – affect UEFI firmware drivers originally meant to be used only during the manufacturing process of Lenovo consumer notebooks. Unfortunately, they were mistakenly included also in the production BIOS images without being properly deactivated. These affected firmware drivers can be activated by an attacker to directly disable SPI flash protections (BIOS Control Register bits and Protected Range registers) or the UEFI Secure Boot feature from a privileged user-mode process during OS runtime.
In addition, while investigating binaries affected by CVE-2021-3971 and CVE-2021-3972, ESET discovered the third vulnerability: SMM memory corruption inside the SMI handler function (CVE-2021-3970). This vulnerability allows arbitrary read/write from/into SMRAM, which can lead to the execution of malicious code with SMM privileges and potentially lead to the deployment of an SPI flash implant.
SPI flash is a small memory chip located on the computer’s motherboard and is often used as a storage for a platform firmware code, including UEFI firmware. To protect this storage against unauthorized modification, chipset provides special protection mechanisms like BIOS Control Register or Protected Range Registers. An UEFI malware that resides on the SPI flash is often referred to as SPI flash implant or UEFI rootkit.
The UEFI boot and runtime services provide the basic functions and data structures necessary for the drivers and applications to do their job, such as installing protocols, locating existing protocols, memory allocation, UEFI variable manipulation, etc. UEFI variables are a special firmware storage mechanism used by UEFI modules to store various configuration data, including boot configuration.
System Management Mode (SMM) is a special highly privileged processor execution mode (even more privileged than OS kernel or Hypervisor). To enter this SMM execution mode, a special System Management Interrupt (SMI) needs to be triggered. When a processor enters SMM execution mode, it has access to the special memory range (referred to as SMRAM), which is hardware-protected against access from non-SMM execution mode. Platform firmware handles invoked SMIs by functions called SMI handlers. These handler functions sometimes process data from untrusted sources (e.g., from OS) and therefore, data should be properly validated before it’s used. Otherwise, the attacker could pass specially crafted input data to the SMI handler, which can result in SMRAM memory corruption and subsequent arbitrary code execution with SMM privileges.
“All of the real-world UEFI threats discovered in the last years – LoJax, MosaicRegressor, MoonBounce, ESPecter, FinSpy – needed to bypass or disable the security mechanisms in some way in order to be deployed and executed,” explains Smolár.
ESET Research strongly advises all owners of Lenovo laptops to go through the list of affected devices and update their firmware by following the manufacturer’s instructions.
For those using End Of Development Support devices affected by the CVE-2021-3972, without any fixes available: one way to help you protect against unwanted modification of the UEFI Secure Boot state is to use a TPM-aware full-disk encryption solution capable of making disk data inaccessible if the UEFI Secure Boot configuration changes.
