UEFI secure startup can be disabled, and Acer has fixed high-risk vulnerabilities that affect many notebooks

CTOnews.com, November 30, Acer (Acer) has fixed a high-risk vulnerability in several laptop models that allows local attackers to disable the UEFI secure boot (UEFI Secure Boot) feature on the target system.

UnsplashCTOnews.com, the source of the picture, learned that on devices equipped with Trusted Platform Module (TPM) chips and Unified Extensible Firmware Interface (UEFI) firmware, the secure boot feature can prevent untrusted operating system startup programs and prevent malicious code such as rootkits and bootkits from loading during startup.

ESET malware researcher Martin Small (Martin Smolar) first reported the problem and found the flaw in the HQSwSmiDxe DXE driver on some consumer Acer laptops, tracking number CVE-2022-4020.

Acer said: "researchers have found a vulnerability that may allow the security startup setting to be changed by creating a NVRAM variable (the actual value of the variable is not important, only the affected firmware driver will check for its existence)."

After exploiting a vulnerability on the affected Acer laptop and turning off the secure boot, the threat can hijack the operating system's loading process and load an unsigned bootstrap to bypass or disable protections. and deploy malicious payloads with system privileges.

A complete list of Acer laptop models affected includes the Acer Aspire A315-22, A115-21, A315-22G, Extensa EX215-21 and EX215-21G.