Multiple Products UEFI Systems CVE-2014-8274 Local Security Bypass Vulnerability

Bugtraq ID:	71873
Class:	Design Error
CVE:	CVE-2014-8274
Remote:	No
Local:	Yes
Published:	Jan 05 2015 12:00AM
Updated:	Jan 05 2015 12:00AM
Credit:	Rafal Wojtczuk, and Corey Kallenberg.
Vulnerable:	Intel NUC with Intel Core i5 processor (D54250WYKH) 0 Intel NUC with Intel Core i5 processor (D54250WYK) 0 Intel NUC with Intel Core i3 processor (D34010WYKH) 0 Intel NUC with Intel Core i3 processor (D34010WYK) 0
Not Vulnerable:

Multiple Products UEFI Systems CVE-2014-8274 Local Security Bypass Vulnerability

Multiple products that implement UEFI systems are prone to a local security-bypass vulnerability.

Attackers with physical access to the computer running the vulnerable firmware can exploit this issue to bypass certain security restrictions and trigger denial-of-service conditions.

Note: Very limited information is currently available regarding this issue. We will update this BID as more information emerges.

Multiple Products UEFI Systems CVE-2014-8274 Local Security Bypass Vulnerability

An attacker with physical access to the computer can exploit this issue.

Multiple Products UEFI Systems CVE-2014-8274 Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Products UEFI Systems CVE-2014-8274 Local Security Bypass Vulnerability

References:

• EFI Boot Script Specification v0.91 (Intel)
  
• BIOS Security Updates for Multiple Issues (Intel)
  
• VU#976132 Some UEFI systems do not properly secure the EFI S3 Resume Boot Path b (CERT)