A newly discovered vulnerability in Phoenix SecureCore UEFI firmware, dubbed “UEFICANHAZBUFFEROVERFLOW”, poses a significant security threat to a wide range of Intel CPUs, including Alder Lake, Coffee Lake, and Kaby Lake. This flaw, tracked as CVE-2024-0762, is a buffer overflow found in the firmware’s Trusted Platform Module (TPM) configuration that can be exploited to perform remote code execution (RCE) on affected devices. Initially identified in Lenovo’s ThinkPad X1 Carbon 7th Gen and X1 Yoga 4th Gen devices, it was later confirmed to affect numerous Intel chip families, potentially impacting hundreds of models from vendors like Lenovo, Dell, Acer, and HP. Despite TPM’s role in enhancing security, the vulnerability lies in the System Management Mode (SMM) subsystem, allowing attackers to overwrite memory and escalate their local privileges, potentially granting them the ability to install bootkit malware. Eclypsium coordinated with Phoenix and Lenovo to address the issue, leading to newly released firmware, though updates for all models are still pending. Phoenix Technologies and Lenovo have urged users to update their firmware promptly to mitigate any risks. This flaw, similar in severity to past UEFI exploits like BlackLotus and MosaicRegressor, highlights the critical nature of UEFI vulnerabilities, which can provide undetectable, privileged backdoor access to systems. At this time, CTIX analysts urge all users of the Eclypsium Platform to scan their devices using the latest available version to identify any vulnerable devices. Technical details can be found in the Eclypsium report linked below.