LogoFAIL: UEFI Vulnerabilities Expose Devices to Stealth Malware Attacks

The Unified Extensible Firmware Interface (UEFI) code from various unbiased firmware/BIOS sellers (IBVs) has been located susceptible to potential assaults by way of high-impression flaws in image parsing libraries embedded into the firmware.

The shortcomings, collectively labeled LogoFAIL by Binarly, “can be applied by threat actors to provide a malicious payload and bypass Safe Boot, Intel Boot Guard, and other security systems by design and style.”

Also, they can be weaponized to bypass security alternatives and produce persistent malware to compromised units throughout the boot phase by injecting a destructive symbol impression file into the EFI system partition.

Though the issues are not silicon-distinct, meaning they impact both equally x86 and ARM-centered equipment, they are also UEFI and IBV-unique. The vulnerabilities comprise a heap-based buffer overflow flaw and an out-of-bounds examine, facts of which are envisioned to be made general public later on this week at the Black Hat Europe conference.

Precisely, these vulnerabilities are triggered when the injected illustrations or photos are parsed, leading to the execution of payloads that could hijack the stream and bypass security mechanisms.

“This attack vector can give an attacker an benefit in bypassing most endpoint security options and providing a stealth firmware bootkit that will persist in an ESP partition or firmware capsule with a modified emblem impression,” the firmware security firm said.

In performing so, threat actors could get entrenched handle in excess of the impacted hosts, ensuing in the deployment of persistent malware that can fly less than the radar.

As opposed to BlackLotus or BootHole, it is really well worth noting that LogoFAIL doesn’t split runtime integrity by modifying the boot loader or firmware component.

The flaws influence all main IBVs like AMI, Insyde, and Phoenix as very well as hundreds of customer and enterprise-quality equipment from vendors, like Intel, Acer, and Lenovo, making it each critical and widespread.

The disclosure marks the initially community demonstration of attack surfaces related to graphic impression parsers embedded into the UEFI method firmware since 2009, when researchers Rafal Wojtczuk and Alexander Tereshkin presented how a BMP impression parser bug could be exploited for malware persistence.

“The styles – and sheer volume – of security vulnerabilities discovered […] show pure solution security maturity and code quality in basic on IBVs reference code,” Binarly famous.

Identified this posting exciting? Adhere to us on Twitter  and LinkedIn to study much more exclusive articles we submit.

Some parts of this article are sourced from:
thehackernews.com