Meltdown & UEFI

Question

I've been trying to understand the risk of an unprotected BIOS being the victim of an UEFI attack using Meltdown and what the risks are compared to the bug being unpatched in the OS.

What is required in order to insert UEFI malware? Is this possible from within the OS, to load code up into UEFI or does it require a physical presence at the machine with a bootable device?

score 7 · Accepted Answer · answered Jan 11 '18 at 14:53

7

There is no relation between Meltdown and UEFI attacks.

Meltdown allows to read kernel memory by using a a cache side-channel used during speculative execution. It does not write anything into privileged memory, or processor microcode.

answered Jan 11 '18 at 14:53

M'vy

13,033
3
47
69

I might have not been clear in my question, but Dell, HP and motherboard manufacturers are releasing BIOS updates to protect against Meltdown attacks. So therefore it must be possible for Meltdown to be used via code which makes it's way into the BIOS? If so, what are the attack vectors and risks versus an OS attack using Meltdown... is that any clearer? – JLo Jan 11 '18 at 15:17
4

They aren't releasing BIOS update as such: they are releasing firmware updates for the CPU which happen to use the same patching mechanism as BIOS – Stephane Jan 11 '18 at 15:21
@JLo, as far as I can tell, the CPU firmware updates (distributed via BIOS) are about fixing Spectre, not Meltdown. – Mark Jan 11 '18 at 22:11

score 2 · Answer 2 · answered May 03 '19 at 21:53

Previous answer is wrong in-part. Yes there is no direct correlation between Meltdown and UEFI attacks (yet) being seen in practice or in theory. But based on the fact that meltdown allows you to read kernel protected memory, the possibility to read any data in memory by incorrectly training the branch predictions.

Secure boot, UEFI and BIOS all rely on total integrity and confidentiality of data within the computational environment. More importantly these vulnerabilities totally subvert Trusted-Execution Environments which are supposed to be cryptographically secure processing units logically separated from the CPU. But speculative execution vulnerabilities allow you to bypass that encryption.

It's only a matter of time before some APT group produces the next Strontium UEFI bootkit and leverages this vulnerability.

Meltdown & UEFI

2 Answers2