Acer fixes UEFI bugs that can be used to disable Secure Boot

Acer has fixed a high-severity vulnerability affecting multiple laptop models that could enable local attackers to deactivate UEFI Secure Boot on targeted systems.

The Secure Boot security feature blocks untrusted operating systems bootloaders on computers with a Trusted Platform Module (TPM) chip and Unified Extensible Firmware Interface (UEFI) firmware to prevent malicious code like rootkits and bootkits from loading during the startup process.

Reported by ESET malware researcher Martin Smolar, the security flaw (CVE-2022-4020) was discovered in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices.

Attackers with high privileges can abuse it in low-complexity attacks that require no user interaction to alter UEFI Secure Boot settings by modifying the BootOrderSecureBootDisable NVRAM variable to disable Secure Boot.

"Researchers have identified a vulnerability that may allow changes to Secure Boot settings by creating NVRAM variables (actual value of the variable is not important, only the existence is checked by the affected firmware drivers)," Acer said.

After exploiting the vulnerability on affected Acer laptops and turning off Secure Boot, threat actors can hijack the OS loading process and load unsigned bootloaders to bypass or disable protections and deploy malicious payloads with system privileges.

The complete list of impacted Acer laptop models includes Acer Aspire A315-22, A115-21, A315-22G, Extensa EX215-21, and EX215-21G.

BIOS update available, Windows update incoming

"Acer recommends updating your BIOS to the latest version to resolve this issue. This update will be included as a critical Windows update," the company added.

Alternatively, customers can download the BIOS update from the company's support website and deploy it manually on affected systems.

Lenovo patched similar bugs found by ESET researchers in multiple ThinkBook, IdeaPad, and Yoga laptop models earlier this month that could allow attackers to deactivate UEFI Secure Boot.

Allowing threat actors to run unsigned, malicious code before OS boot can lead to severe consequences, including the deployment of malware that can persist between OS re-installations and bypassing anti-malware protections provided by security solutions.

In the case of Lenovo, the issue was caused by the company's developers including an early development driver in production drivers that could change secure boot settings from the OS.

In January, ESET found three other UEFI firmware flaws that could enable attackers to hijack the startup routine on more than 70 Lenovo device models running Windows.