Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Endpoint Security

Hundreds of PC, Server Models Possibly Affected by Serious Phoenix UEFI Vulnerability

Hundreds of PC and server models may be affected by CVE-2024-0762, a privilege escalation and code execution flaw in Phoenix SecureCore UEFI firmware.

UEFI vulnerability

Hundreds of PC and server models that use Intel processors could be affected by a high-severity vulnerability found recently in Phoenix Technologies’ SecureCore UEFI firmware solution.

The vulnerability, tracked as CVE-2024-0762 and dubbed UEFIcanhazbufferoverflow, was discovered by an automated analysis system developed by enterprise firmware and hardware security firm Eclypsium. 

The security hole can be exploited by a local attacker to escalate privileges and execute arbitrary code within the UEFI firmware during runtime. 

Eclypsium warned that this is a type of vulnerability that may be leveraged by threats such as the Black Lotus UEFI rootkit.

“This vulnerability exemplifies two characteristic traits of IT infrastructure supply chain incidents—high impact and broad reach. UEFI firmware is some of the most high-value code on modern devices, and any compromise of that code can give attackers full control and persistence on the device,” Eclypsium noted.

An investigation showed that the vulnerability is related to an unsafe variable in the Trusted Platform Module (TPM) configuration. The vulnerable SecureCore UEFI firmware runs on multiple Intel mobile, desktop and server processors used by computer makers such as Lenovo, Acer, Dell and HP. 

Phoenix Technologies addressed the vulnerability in an advisory published in May, confirming that the SecureCore firmware running on Intel processor families such as Alder Lake, Coffee Lake, Comet Lake, Ice Lake, Jasper Lake, Kaby Lake, Meteor Lake, Raptor Lake, Rocket Lake, and Tiger Lake are impacted.

Phoenix has patched CVE-2024-0762 and device manufacturers have started deploying the patch to their products. 

Advertisement. Scroll to continue reading.

Lenovo informed customers about the vulnerability in an advisory published in May. The company has started releasing patches, and for some computers fixes are expected to become available later this summer. 

Related: Most Linux Systems Exposed to Complete Compromise via Shim Vulnerability 

Related: New AMI BMC Flaws Allowing Takeover and Physical Damage Could Impact Millions of Devices

Related: Gigabyte Rolls Out BIOS Updates to Remove Backdoor From Motherboards

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

SaaS security company AppOmni has hired Joel Wallenstrom as its General Manager.

FTI Consulting has appointed Brett Callow as Managing Director in its Cybersecurity & Data Privacy Communications practice.

Mobile security firm Zimperium has welcomed David Natker as its VP of Global Partners and Alliances.

More People On The Move

Expert Insights