Acer has fixed a high-severity vulnerability affecting multiple laptop models that could enable local attackers to deactivate UEFI Secure Boot on targeted systems.
The Secure Boot security feature blocks untrusted operating systems bootloaders on computers with a Trusted Platform Module (TPM) chip and Unified Extensible Firmware Interface (UEFI) firmware to prevent malicious code like rootkits and bootkits from loading during the startup process.
Reported by ESET malware researcher
Martin Smolar, the security flaw (
CVE-2022-4020) was discovered in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices.
Attackers with high privileges can abuse it in low-complexity attacks that require no user interaction to alter UEFI Secure Boot settings by modifying the BootOrderSecureBootDisable NVRAM variable to disable Secure Boot.
"Researchers have identified a vulnerability that may allow changes to Secure Boot settings by creating NVRAM variables (actual value of the variable is not important, only the existence is checked by the affected firmware drivers)," Acer
said.
After exploiting the vulnerability on affected Acer laptops and turning off Secure Boot, threat actors can hijack the OS loading process and load unsigned bootloaders to bypass or disable protections and deploy malicious payloads with system privileges.
![[correlate]](/data/avatars/s/79/79653.jpg?1556985072){kind=avatar}
