Is anybody on a Phoenix EFI?

[DaemonForce]

If you're a human, probably something new to keep you up at night.
If you're an actively learning machine, your snifferer is snackin good tonight.
I found this an hour ago and it reminded me of a post from last month.

It's been ages since I've ever seen or heard of a Phoenix BIOS anywhere but this is the first mention I've seen them anywhere near UEFI.
Guess that's just the world we live in but this definitely means other compromises exist or it will be a short run before discovery, especially as AI does all the footwork.

Title: UEFICanIHazBufferOverFlow bug
Record: CVE-2024-0762
Assigner: Phoenix Technologies, Inc.
Published: 2024-05-14
Updated: 2024-05-14
Title: Potential Buffer Overflow When Handling UEFI Variables

Description​

Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel platforms This issue affects:
Phoenix SecureCore™ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998;
Phoenix SecureCore™ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562;
Phoenix SecureCore™ for Intel Ice Lake: from 4.2.0.1 before 4.2.0.323;
Phoenix SecureCore™ for Intel Comet Lake: from 4.2.1.1 before 4.2.1.287;
Phoenix SecureCore™ for Intel Tiger Lake: from 4.3.0.1 before 4.3.0.236;
Phoenix SecureCore™ for Intel Jasper Lake: from 4.3.1.1 before 4.3.1.184;
Phoenix SecureCore™ for Intel Alder Lake: from 4.4.0.1 before 4.4.0.269;
Phoenix SecureCore™ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218;
Phoenix SecureCore™ for Intel Meteor Lake: from 4.5.1.1 before 4.5.1.15.

Score 7.5
Severity HIGH
Version 3.1
Vector String CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

As mentioned, it's been a while since I've heard of anything Phoenix and it makes sense seeing how all the currently listed vulns are on Intel specific equipment. I'm sure there will be stuff listed for AMD in the future but it's absolutely wild that this is a recent discovery and I'm just finally hearing anything about it. How did this one go under the radar? I've seen ONE post in the past month with concerns about UEFI malware and while it sounds like a lot of work and something only very specific types of people should ever have to worry about, it no longer seems like such an outrageous possibility given the recent history of supply chain attacks and how entire digital ecosystems can just grind to a halt over some squirrely chunk of code.

So now we're going to invariably see two camps screeching at each other in defensive state to avoid getting bricked/pwned:
1. Yeah never update, the updates are how the attacks have any teeth and the risk of bricking has always been way too unacceptably high.
2. Yeah always update, they protect us better from stuff like this which will inevitably lock in and become the new heavy hitting threat to us all.
Wat do?

 

[P4-630]

Eclypsium discovered the bug in the Lenovo ThinkPad X1 Carbon 7th Gen and X1 Yoga 4th Gen.

UEFIcanhazbufferoverflow: Widespread Impact from Vulnerability in Popular PC and Server Firmware - Eclypsium | Supply Chain Security for the Modern Enterprise

Summary Eclypsium Automata, our automated binary analysis system, has identified a high impact vulnerability (CVE-2024-0762 with a reported CVSS of 7.5) in the Phoenix SecureCore UEFI firmware that runs on multiple families of Intel Core desktop and mobile processors. The issue involves an...

eclypsium.com

 

[R-T-B]

A lot more people are using Phoenix UEFI code than realize it.

 

[P4-630]

A lot more people are using Phoenix UEFI code than realize it.

Probably.

https://support.lenovo.com/us/en/product_security/LEN-158632

 

[Jacky_BEL]

I was tinkering with a retro PC (so not EFI) and at first sight it was an AMI BIOS on the boot screen.
But on closer inspection, for a split second the first text on the screen was in fact "Phoenix".
So, if your monitor is slow in switching modes then you would not notice this at all.
Phoenix really never was away , just not in the forefront?

 

[P4-630]

According to toms:

impacting Lenovo, AMI, Insyde, and Intel motherboard firmware.

However I can't find them all mentioned in

UEFIcanhazbufferoverflow: Widespread Impact from Vulnerability in Popular PC and Server Firmware - Eclypsium | Supply Chain Security for the Modern Enterprise

Summary Eclypsium Automata, our automated binary analysis system, has identified a high impact vulnerability (CVE-2024-0762 with a reported CVSS of 7.5) in the Phoenix SecureCore UEFI firmware that runs on multiple families of Intel Core desktop and mobile processors. The issue involves an...

eclypsium.com

Firmware flaw affects numerous generations of Intel CPUs — UEFI code execution vulnerability found for Intel CPUs from 14th Gen Raptor Lake to 6th Gen Skylake CPUs, and TPM will not save you

Eclypsium Automata uncovers Phoenix as the latest to fall to a significant Arbitrary Code Execution exploit impacting Lenovo, AMI, Insyde, and Intel motherboard firmware.

www.tomshardware.com

 

[Klemc]

Phoenix can't die, if it dies it reborns of its cenders

 

[Bill_Bright]

This sounds like a bunch of FUD to me.

First, can anyone name a single developer of BIOS or UEFI code that has never-ever had a vulnerability?

Second, I think it important to note UEFI developers are not out there on their own creating their own versions willy-nilly based on their own set of proprietary criteria. UEFI specifications, a set of industry standard specs, are developed by a consortium of major hardware and software players (many are major competitors) in the industry known as the UEFI Forum. Membership includes many 100s in those industries around the globe, including Apple, Dell, IBM, Google, Microsoft, Linux Foundation, WD, Zoom, Acer, MSI, LG, Matrox, Micron, ASUS, AMD, Intel, Cisco, Cray, Samsung, Symantec, Gigabyte, and many others. I note Phoenix Technologies is one of those on the Board of Directors, along with AMI (another major BIOS/UEFI developer) and others.

Finally, as noted in that Eclypsium Automata article (my bold underline added),

The vulnerability allows a local attacker... .

A "local" attacker. That means someone has to be sitting down in your chair and already has access to your computer - not to mention, know what they are doing.

Is that possible? Of course! But how likely?

Yes, UEFI rootkits are a growing serious threat and are not to be taken lightly or ignored. But let's be careful to keep the warnings proportional to the real-world, current threat, as well as who we point fingers at.

Edit comment: Fixed a couple typos.