BRLY-2021-033

SMM memory corruption vulnerability in SMM driver on multiple HP devices.

Public Disclosure Date: Mar 8, 2022

CVE ID

CVE-2022-23925

[Device](https://support.hp.com/us-en/drivers/selfservice/hp-prodesk-405-g6-small-form-factor-pc/38230306) / firmware version: `02.05.01 Rev.A`

Summary

BINARLY efiXplorer team has discovered a SMM memory corruption vulnerability on multiple HP devices allowing a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Potential Impact

An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in the System Management Mode - an environment more privileged than operating system (OS) and completely isolated from it. Running arbitrary code in SMM additionally bypasses SMM-based SPI flash protections against modifications, which can help an attacker to install a firmware backdoor/implant into the BIOS. Such a malicious firmware code in the BIOS could persist across operating system re-installs. Additionally, this vulnerability potentially could be used by threat actors to bypass security mechanisms provided by the UEFI firmware (for example, Secure Boot and some types of memory isolation for hypervisors).

Vulnerability Information

BINARLY internal vulnerability identifier: BRLY-2021-033
HP PSIRT assigned CVE identifier: CVE-2022-23925
CERT/CC assigned case number: VU#683814
CVSS v3.1 8.2 High AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Table of Contents

01.Affected HP firmware

02.Vulnerability description

03.Disclosure timeline

04.Acknowledgements

Affected HP firmware

Device/Firmware	File Name	SHA256 (File PE32 section)	File GUID
Device / firmware version: `02.05.01 Rev.A`	0155	ab8b10ee19403060cc340c87e7c53f10569a60538279b76f732e6085c0b92a4e	6F627C09-91F3-4A14-B301-306CEFCF999A

Vulnerability description

The vulnerability exists in the child SW SMI handler registered with GUID e0c277cb-e633-4a8c-b0c6-49e8d685aa30 and located at offset 0x246C in the driver. The pseudocode for this handler is shown below:

EFI_STATUS __fastcall SmiHandler_246C(
        EFI_HANDLE DispatchHandle,
        const void *Context,
        CommBuffer *CommBuffer,
        UINTN *CommBufferSize)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

  if ( CommBuffer && CommBufferSize && (-(*CommBufferSize != 64) & EFI_INVALID_PARAMETER) == 0 )
  {
    Header = 'UBES';
    Error = -(CommBuffer->Header != 'UBES') & EFI_INVALID_PARAMETER;
    if ( CommBuffer->Header == 'UBES' )
    {
      if ( !CommBuffer->EnableChecks
        || !sub_40E8('UBES', Context)
        || CommBuffer->Case == 2
        || sub_324C()
        || sub_3088(CommBuffer->field_30, CommBuffer->field_28, 0i64) )
      {
        Error = 0i64;
      }
      else
      {
        Error = EFI_ACCESS_DENIED;
      }
    }
    if ( Error )
      goto _Exit;
    Case = CommBuffer->Case;
    if ( Case > 5 )
    {
      Case1 = Case - 6;
      if ( Case1 )
      {
        Case2 = Case1 - 1;
        if ( Case2 )
        {
          Case3 = Case2 - 1;
          if ( Case3 )
          {
            if ( Case3 != 1 )
            {
_Exit1:
              Error = EFI_INVALID_PARAMETER;
              goto _Exit;
            }
            // Case3 = CommBuffer->Case - 8 = 1
            // CommBuffer->Case = 9
            Res = ToCopyMemS(CommBuffer->Offset, CommBuffer->Dst, CommBuffer->DstSize);
          }
          ...
        }
        ...
      }
      ...
    }
    ...
  }
  return 0;
}

Let's assume that the CommBuffer has following structure:

00000000 CommBufferStruc struc ; (sizeof=0x40, mappedto_235)
00000000 Header          dd ?
00000004 field_4         dd ?
00000008 Case            dd ?
0000000C                 db ?
0000000D                 db ?
0000000E                 db ?
0000000F                 db ?
00000010 Offset          dq ? ; Pointer
00000018 Dst             dq ? ; Pointer
00000020 DstSize         dd ? ; Pointer
00000024 EnableChecks    db ?
00000025 field_25        db ?
00000026                 db ?
00000027                 db ?
00000028 field_28        dq ?
00000030 field_30        dw ?
00000032                 db ?
00000033                 db ?
00000034                 db ?
00000035                 db ?
00000036                 db ?
00000037                 db ?
00000038 field_38        dq ?
00000040 CommBufferStruc ends

CommBuffer->Header should be equal to 0x55424553 (UBES). If we set CommBuffer->EnableChecks to 0x00 and CommBuffer->Case to 0x09 than we will trigger the following code:

Res = ToCopyMemS(CommBuffer->Offset, CommBuffer->Dst, CommBuffer->DstSize);

Consider the ToCopyMemS function (offset: 0x1774):

__int64 __fastcall ToCopyMemS(__int64 Offset, void *DstBuffer, unsigned int DstBufferSize)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

  Status = 0i64;
  if ( !DstBuffer || !DstBufferSize )
    return EFI_INVALID_PARAMETER;
  if ( gProprietaryprotocol1Located )           // Should be zero
    return (*(gProprietaryprotocol_1 + 2))(gArgs[0] + Offset);
  Func = *(gProprietaryprotocol_2 + 2);
  if ( !Func )                                  // Should be zero
  {
    CopyMemS(DstBuffer, DstBufferSize, (Offset + gArgs[0]), DstBufferSize);
    return Status;
  }
  return Func(gArgs[0] + Offset);
}

the variable gProprietaryprotocol1Located equals 0 because the gProprietaryprotocol_1 protocol with GUID 2452b851-87b5-4225-abf6-c3819cf11256 cannot be located (it is not installed elsewhere)
- below is code from function with offset 0x27C8 that tries to locate the protocol with GUID 2452b851-87b5-4225-abf6-c3819cf11256 (ProprietaryProtocol1Guid):
```
Proprietaryprotocol = 0;
Status = gSmst->SmmLocateProtocol(&ProprietaryProtocol1Guid, 0, &gProprietaryprotocol_1);
if ( Status )
  Status = gSmst->SmmLocateProtocol(&ProprietaryProtocol2Guid, 0, &gProprietaryprotocol_2);
else
  gProprietaryprotocol1Located = 1;
```
Func equals 0 because gProprietaryprotocol_2 interface (installed in driver 230D with GUID D9E13697-277E-45F0-8F09-841370367FEB) has following structure: <offset Func1, offset Func2, 0>

This means that the CopyMemS function will be executed and data from (Offset + gArgs[0]) will be copied to DstBuffer = CommBuffer->Dst.

The nested pointer CommBuffer->Dst is not validated and a potential attacker could use this to overwrite the contents of SMRAM.

To exploit this vulnerability it is enough to:

Setup Communication Buffer:

CommBuffer->Header = 0x55424553
CommBuffer->EnableChecks = 0
CommBuffer->Case = 9
CommBuffer->Dst = {address from SMRAM}

Trigger the SW SMI Handler (SW SMI number and pointer to Communication Buffer are specified in UEFI ACPI table) via 0xB2 IO port

Disclosure timeline

This bug is subject to a 90 day disclosure deadline. After 90 days elapsed or a patch has been made broadly available (whichever is earlier), the bug report will become visible to the public.

Disclosure Activity	Date
HP PSIRT is notified	2021-07-12
HP PSIRT confirmed reported issue	2021-08-09
HP PSIRT assigned CVE number	2021-08-19
CERT/CC created a case	2021-11-16
HP PSIRT provide patch release	2022-03-08
BINARLY public disclosure date	2022-03-08

Acknowledgements

BINARLY efiXplorer team

See if you are impacted now with our Firmware Vulnerability Scanner

Find Vulnerabilities, Generate SBOMs & CBOMs

Scan Now

Potential Impact

Device/Firmware

File Name

SHA256 (File PE32 section)

File GUID

Device / firmware version: 02.05.01 Rev.A

0155

ab8b10ee19403060cc340c87e7c53f10569a60538279b76f732e6085c0b92a4e

6F627C09-91F3-4A14-B301-306CEFCF999A

EFI_STATUS __fastcall SmiHandler_246C( EFI_HANDLE DispatchHandle, const void *Context, CommBuffer *CommBuffer, UINTN *CommBufferSize) { // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND] if ( CommBuffer && CommBufferSize && (-(*CommBufferSize != 64) & EFI_INVALID_PARAMETER) == 0 ) { Header = 'UBES'; Error = -(CommBuffer->Header != 'UBES') & EFI_INVALID_PARAMETER; if ( CommBuffer->Header == 'UBES' ) { if ( !CommBuffer->EnableChecks || !sub_40E8('UBES', Context) || CommBuffer->Case == 2 || sub_324C() || sub_3088(CommBuffer->field_30, CommBuffer->field_28, 0i64) ) { Error = 0i64; } else { Error = EFI_ACCESS_DENIED; } } if ( Error ) goto _Exit; Case = CommBuffer->Case; if ( Case > 5 ) { Case1 = Case - 6; if ( Case1 ) { Case2 = Case1 - 1; if ( Case2 ) { Case3 = Case2 - 1; if ( Case3 ) { if ( Case3 != 1 ) { _Exit1: Error = EFI_INVALID_PARAMETER; goto _Exit; } // Case3 = CommBuffer->Case - 8 = 1 // CommBuffer->Case = 9 Res = ToCopyMemS(CommBuffer->Offset, CommBuffer->Dst, CommBuffer->DstSize); } ... } ... } ... } ... } return 0; }

00000000 CommBufferStruc struc ; (sizeof=0x40, mappedto_235) 00000000 Header dd ? 00000004 field_4 dd ? 00000008 Case dd ? 0000000C db ? 0000000D db ? 0000000E db ? 0000000F db ? 00000010 Offset dq ? ; Pointer 00000018 Dst dq ? ; Pointer 00000020 DstSize dd ? ; Pointer 00000024 EnableChecks db ? 00000025 field_25 db ? 00000026 db ? 00000027 db ? 00000028 field_28 dq ? 00000030 field_30 dw ? 00000032 db ? 00000033 db ? 00000034 db ? 00000035 db ? 00000036 db ? 00000037 db ? 00000038 field_38 dq ? 00000040 CommBufferStruc ends

__int64 __fastcall ToCopyMemS(__int64 Offset, void *DstBuffer, unsigned int DstBufferSize) { // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND] Status = 0i64; if ( !DstBuffer || !DstBufferSize ) return EFI_INVALID_PARAMETER; if ( gProprietaryprotocol1Located ) // Should be zero return (*(gProprietaryprotocol_1 + 2))(gArgs[0] + Offset); Func = *(gProprietaryprotocol_2 + 2); if ( !Func ) // Should be zero { CopyMemS(DstBuffer, DstBufferSize, (Offset + gArgs[0]), DstBufferSize); return Status; } return Func(gArgs[0] + Offset); }

Proprietaryprotocol = 0; Status = gSmst->SmmLocateProtocol(&ProprietaryProtocol1Guid, 0, &gProprietaryprotocol_1); if ( Status ) Status = gSmst->SmmLocateProtocol(&ProprietaryProtocol2Guid, 0, &gProprietaryprotocol_2); else gProprietaryprotocol1Located = 1;

Disclosure Activity

Date

HP PSIRT is notified

2021-07-12

HP PSIRT confirmed reported issue

2021-08-09

HP PSIRT assigned CVE number

2021-08-19

CERT/CC created a case

2021-11-16

HP PSIRT provide patch release

2022-03-08

BINARLY public disclosure date

2022-03-08

Potential Impact

Image preview

Vulnerability Information

Image preview

Affected HP firmware

Image preview

Vulnerability description

Image preview

Disclosure timeline

Image preview

Acknowledgements

Image preview

See if you are impacted now with our Firmware Vulnerability Scanner

Potential Impact

Image preview

Vulnerability Information

Image preview

Affected HP firmware

Image preview

Vulnerability description

Image preview

Disclosure timeline

Image preview

Acknowledgements

Image preview

See if you are impacted now with our Firmware Vulnerability Scanner