PR3MIUM
Senior Member
UEFIcanhazbufferoverflow: Widespread Impact from Vulnerability in Popular PC and Server Firmware
Eclypsium Automata, our automated binary analysis system, has identified a high impact vulnerability (CVE-2024-0762 with a reported CVSS of 7.5) in the Phoenix SecureCore UEFI firmware that runs on multiple families of Intel Core desktop and mobile processors. The issue involves an unsafe variable in the Trusted Platform Module (TPM) configuration that could lead to a buffer overflow and potential malicious code execution. To be clear, this vulnerability lies in the UEFI code handling TPM configuration—in other words, it doesn’t matter if you have a security chip like a TPM if the underlying code is flawed.
![phonuefi_screen.png](/proxy.php?image=https%3A%2F%2Feclypsium.com%2Fwp-content%2Fuploads%2Fphonuefi_screen.png&hash=96e075e01b6a37e764d6954f991d88b5)
Source:
![eclypsium.com](/proxy.php?image=https%3A%2F%2Feclypsium.com%2Fwp-content%2Fuploads%2Ffeature_image_phonuefi3.png&hash=77679f5d3c254134b0248650020f7b0e&return_error=1)
UEFIcanhazbufferoverflow: Widespread Impact from Vulnerability in Popular PC and Server Firmware - Eclypsium | Supply Chain Security for the Modern Enterprise
Summary Eclypsium Automata, our automated binary analysis system, has identified a high impact vulnerability (CVE-2024-0762 with a reported CVSS of 7.5) in the Phoenix SecureCore UEFI firmware that runs on multiple families of Intel Core desktop and mobile processors. The issue involves an...
![eclypsium.com](/proxy.php?image=https%3A%2F%2Feclypsium.com%2Fwp-content%2Fuploads%2FEclypsium-Favicon.jpg&hash=256399965e681e5720c114810ae3ac7a&return_error=1)