Extreme Privilege Escalation on Windows 8/UEFI Systems (paper and slides)

MrBrian · Oct 5, 2014

From https://www.blackhat.com/us-14/archives.html#extreme-privilege-escalation-on-windows-8-uefi-systems:

The UEFI specification has more tightly coupled the bonds of the operating system and the platform firmware by providing the well-defined "runtime services" interface between the operating system and the firmware.

This interface is more expansive than the interface that existed in the days of conventional BIOS, which has inadvertently increased the attack surface against the platform firmware. Furthermore, Windows 8 has introduced APIs that allow accessing this UEFI interface from a userland process. Vulnerabilities in this interface can potentially allow a userland process to escalate its privileges from "ring 3" all the way up to that of the platform firmware, which includes permanently attaining control of the very-powerful System Management Mode (SMM).

This talk will disclose two of these vulnerabilities that were discovered in the Intel provided UEFI reference implementation, and detail the unusual techniques needed to successfully exploit them.
Click to expand...

"Vulnerability Disclosure & Vendor Response" is on pp. 45-48 of the slides. Also see Vulnerability Note VU#552286: UEFI EDK2 Capsule Update vulnerabilities.

Log in or Sign up

Extreme Privilege Escalation on Windows 8/UEFI Systems (paper and slides)

MrBrian Registered Member

Log in or Sign up

Extreme Privilege Escalation on Windows 8/UEFI Systems (paper and slides)

MrBrian Registered Member

Useful Searches