SMM arbitrary code execution vulnerability in SMM module on Fujitsu device.

The vulnerability was originally discovered on Fujitsu device mentioned below, however later it was confirmed by AMI PSIRT this issue is inside AMI's product.

Image preview

Let's consider the vulnerability on the example of a module with SHA256 d3715136d50fc486ef59fb4aee1d7f06552fdf98423809939538fe905a1aa0b3. The pseudocode of the vulnerable ChildSwSmiHandler function (with the HandlerType: EFI_SMM_RUNTIME_PROTOCOL_GUID) is presented below:

EFI_STATUS __fastcall ChildSwSmiHandler(
        EFI_HANDLE DispatchHandle,
        const void *Context,
        char *CommBuffer,
        UINTN *CommBufferSize)
{
  __int64 Ptr; // [rsp+20h] [rbp-18h]

  Ptr = *(CommBuffer + 4);
  if ( Ptr )
  {
    (*(Ptr + 8))(*Ptr, gSmst, CommBuffer + 24); // Arbitrary function call
    *(CommBuffer + 4) = 0;
  }
  return EFI_SUCCESS;
}

As we can see from the pseucode, since a possible attacker controls the contents of СommBuffer, it allows to specify an arbitrary pointer of a function called here (*(Ptr + 8))(*Ptr, gSmst, CommBuffer + 24). Which will lead to hijacking of the execution flow.

To fix this vulnerability, a call to an arbitrary function must be removed and replaced by a call the function from a table that is already located in SMRAM.

Image preview

This bug is subject to a 90 day disclosure deadline. After 90 days elapsed or a patch has been made broadly available (whichever is earlier), the bug report will become visible to the public.

Image preview

BINARLY efiXplorer team

Image preview