Brand ClaimErleben, was verbindet

Advisory 2023-2617 - UEFI BIOS: Multiple Vulnerabilities

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2023-2617
Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.
1
Attack probability
low
5
Potential damage
high
local attacker
Date
2023-12-07
Release
2024-12-17 UPDATE

Operating System

  • BIOS/Firmware

Software

  • Insyde UEFI Firmware kernel 5.2 < Version 05.28.47
  • Insyde UEFI Firmware kernel 5.3 < Version 05.37.47
  • Insyde UEFI Firmware kernel 5.4 < Version 05.45.47
  • Insyde UEFI Firmware kernel 5.5 < Version 05.53.47
  • Insyde UEFI Firmware kernel 5.6 < Version 05.60.47
  • Lenovo BIOS
  • UPDATE 2024-07-01
  • HP Computer
  • UPDATE 2024-12-17
  • Dell PowerScale OneFS < 12.4.1

Attack

A local attacker can exploit several vulnerabilities in the UEFI BIOS of different manufacturers to execute arbitrary program code with administrator rights or to cause a denial of service condition.

Description

The BIOS is the firmware on IBM PC compatible computers. InsydeH2O UEFI BIOS is a proprietary, licensed UEFI BIOS firmware that supports Intel and AMD based computers.

CVE-2023-39538, CVE-2023-39539, CVE-2023-40238, CVE-2023-5058

There are several vulnerabilities known as "LogoFail" in the UEFI BIOS of various manufacturers. These are due to errors in the processing of logo files in the boot process. A local attacker with elevated privileges can exploit these vulnerabilities to execute arbitrary program code with administrator rights or to cause a denial of service.

CVSSv2 Base Score: 6.0 / Temporal Score: 4.5
AV:L/AC:H/AU:S/C:C/I:C/A:C/E:U/RL:OF/RC:ND
CVSSv3.1 Base Score: 7.5 / Temporal Score: 6.5
AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:X

Recommendation

Lenovo provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://support.lenovo.com/us/en/product_security/LEN-145284

Insyde provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.insyde.com/security-pledge/SA-2023053

UPDATE 2024-07-01

HP provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://support.hp.com/us-en/document/ish_10832513-10832541-16/HPSBHF03950

UPDATE 2024-12-17

Dell provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.dell.com/support/kbdoc/de-de/000260794/dsa-2024-455-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities

Information

Binarly Research "LogoFAIL" dated 2023-12-06
https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html

CERT Coordination Center Vulnerability Note VU#811862 dated 2023-12-06
https://www.kb.cert.org/vuls/id/811862

Insyde Security Advisory 2023053 dated 2023-12-06
https://www.insyde.com/security-pledge/SA-2023053

Lenovo Security Advisory LEN-145284 dated 2023-12-06
https://support.lenovo.com/us/en/product_security/LEN-145284

GitHub Security Advisory GHSA-87fm-wcxm-mcmx dated 2023-12-06
https://github.com/advisories/GHSA-87fm-wcxm-mcmx

GitHub Security Advisory GHSA-xhch-7j88-pg68 dated 2023-12-06
https://github.com/advisories/GHSA-xhch-7j88-pg68

UPDATE 2024-07-01

HP Security Bulletin HPSBHF03950 dated 2024-06-07
https://support.hp.com/us-en/document/ish_10832513-10832541-16/HPSBHF03950

UPDATE 2024-12-17

Dell Security Advisory DSA-2024-455 dated 2024-12-16
https://www.dell.com/support/kbdoc/de-de/000260794/dsa-2024-455-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities

References

CERT/CC:VU#811862
CERT/CC-VN:VU#811862
CVE:CVE-2023-39538
CVE:CVE-2023-39539
CVE:CVE-2023-40238
CVE:CVE-2023-5058
DELL:DSA-2024-455
GITHUB:GHSA-87FM-WCXM-MCMX
GITHUB:GHSA-XHCH-7J88-PG68
HP:HPSBHF03950
INSYDE:INSYDE-SA-2023053
LENOVO:LEN-145284
VULNAME:LOGOFAIL

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.