Security Vulnerability in Phoenix SecureCore UEFI Firmware Affects Hundreds of Intel CPUs

TapTechNews June 21, a security vulnerability in Phoenix SecureCore UEFI firmware was exposed, affecting hundreds of Intel CPU devices, and Lenovo has now released a new firmware update to fix the bug.

TapTechNews learned from the report that the bug tracking number is CVE-2024-0762, known as UEFI CAN HAZ BUFFER OVERFLOW, which exists in the Trusted Platform Module (TPM) configuration in Phoenix UEFI firmware and is a buffer overflow vulnerability that can be exploited to execute arbitrary code on vulnerable devices.

The vulnerability was discovered by Eclypsium, who found it on Lenovo ThinkPad X1 Carbon 7th generation and X1 Yoga 4th generation devices and then confirmed with Phoenix that it affects the following Intel CPUs' SecureCore firmware:

Alder Lake

Coffee Lake

Comet Lake

Ice Lake

Jasper Lake

Kaby Lake

Meteor Lake

Raptor Lake

Rocket Lake

Tiger Lake

Because of the large number of Intel CPUs using this firmware, the bug has the potential to affect hundreds of models of Lenovo, Dell, Acer and HP.

Eclypsium said the vulnerability they found is a buffer overflow in the System Management Mode (SMM) subsystem of Phoenix SecureCore firmware, allowing attackers to overwrite adjacent memory.

If the memory is overwritten with the correct data, attackers could potentially escalate privileges and gain the ability to execute code in the firmware, thereby installing bootstrap toolkit malware.

Phoenix issued a warning in April, and Lenovo released a new firmware in May to fix the bug problem for more than 150 different models, but other manufacturers have not fully followed up to fix it yet.