Intel Corp., American Megatrends Inc. and Phoenix Technologies Inc. have patched a firmware vulnerability in a few of their products that would have given attackers a way to subvert some of the security checks performed on a system during the startup process.

In an advisory Monday, the U.S. Computer Emergency Response Team (CERT) said the issue affects systems featuring the Unified Extensible Firmware Interface (UEFI), a technology designed to replace the Basic Input/Output System interface used in PCs for years.

Access Restriction Failure

The firmware vulnerability stems from a failure by some UEFI systems to restrict access to a script used by the firmware to ensure only trusted software is used by the system when it is booting up. The boot script plays an important role in ensuring the system remains secure during the startup process, according to the two security researchers — Rafal Wojtczuk of Bromium and Corey Kallenberg of The MITRE Corp. — who reported the bug.

“However, we have discovered that on certain systems, the boot script resides in unprotected memory, which can be tampered with by an attacker with access to physical memory,” they said.

Secure Boot Bypass

The firmware vulnerability lets an authenticated user bypass the “Secure Boot” process and perform an arbitrary reflash of the platform firmware, CERT said in its alert. An attacker could also take advantage of the flaw to arbitrarily read or write to the system management RAM region of processor memory and corrupt the platform malware to make the system inoperable.

Secure Boot is a feature in Microsoft’s Windows 8 operating system that is designed to ensure PCs only boot up using properly authenticated software. It takes advantage of UEFI to verify the signature of each piece of software used during the startup process before allowing the system to run, according to Microsoft’s description of the technology.

Vendor Response to Firmware Vulnerability

In a prepared statement, Intel acknowledged that the issue affected some of its products. The company noted that it has already issued a system firmware update to mitigate the issue. The problems described in the CERT advisory assume an attacker has already compromised the operating system.

American Megatrends said it has addressed the problem on a “generic basis” and is working with original equipment manufacturers to patch vulnerable systems that have already been deployed. Phoenix said it has investigated the issue and discovered some of its currently shipping products are vulnerable. The company has a patch for the issue and is working with original equipment manufacturers to distribute the updated source code.