Vulnerability Note VU#976132
Some UEFI systems do not properly secure the EFI S3 Resume Boot Path boot script
Original Release date: 05 Jan 2015 | Last revised: 03 Feb 2015
Some UEFI systems fail to properly restrict access to the boot script used by the EFI S3 Resume Boot Path, allowing an authenticated, local attacker to bypass various firmware write protections.
According to Rafal Wojtczuk of Bromium and Corey Kallenberg of The MITRE Corporation:
"During the UEFI S3 Resume path, a boot script is interpreted to re-initialize the platform. The boot script dictates various memory and port read/write operations to facilitate this re-initialization. The boot script is interpreted early enough where important platform security mechanisms have not yet been configured. For example, BIOS_CNTL, which helps protects the platform firmware against arbitrary writes, is unlocked. TSEGMB, which protects SMRAM against DMA, is also unlocked.
Given this, the boot script is in a security critical position and maintaining its integrity is important. However, we have discovered that on certain systems the boot script resides in unprotected memory which can be tampered with by an attacker with access to physical memory."
An authenticated local attacker may be able to bypass Secure Boot and/or perform an arbitrary reflash of the platform firmware despite the presence of signed firmware update enforcement. Additionally, the attacker could arbitrarily read or write to the SMRAM region. Lastly, the attacker could corrupt the platform firmware and cause the system to become inoperable.
Please see the Vendor Information section below to determine if your system may be affected. We are continuing to communicate with vendors as they investigate these vulnerabilities.
Vendor Information (Learn More)
VendorStatusDate NotifiedDate UpdatedAmerican Megatrends Incorporated (AMI)Affected15 Sep 201410 Dec 2014
Dell Computer Corporation, Inc.Affected15 Sep 201422 Jan 2015
Insyde Software CorporationAffected-03 Feb 2015
Intel CorporationAffected15 Sep 201429 Dec 2014
LenovoAffected-21 Jan 2015
Phoenix Technologies Ltd.Affected06 Oct 201419 Dec 2014If you are a vendor and your product is affected, let
CVSS Metrics (Learn More)
Thanks to Rafal Wojtczuk and Corey Kallenberg for reporting this vulnerability, as well as Intel Advanced Threat Research.
This document was written by Todd Lewellen.
28 Dec 2014
Date First Published:
05 Jan 2015
Date Last Updated:
03 Feb 2015
FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.