Headline
New Flaw in Acer Laptops Could Let Attackers Disable Secure Boot Protection
Acer has released a firmware update to address a security vulnerability that could be potentially weaponized to turn off UEFI Secure Boot on affected machines. Tracked as CVE-2022-4020, the high-severity vulnerability affects five different models that consist of Aspire A315-22, A115-21, and A315-22G, and Extensa EX215-21 and EX215-21G.
The PC maker described the vulnerability as
Acer has released a firmware update to address a security vulnerability that could be potentially weaponized to turn off UEFI Secure Boot on affected machines.
Tracked as CVE-2022-4020, the high-severity vulnerability affects five different models that consist of Aspire A315-22, A115-21, and A315-22G, and Extensa EX215-21 and EX215-21G.
The PC maker described the vulnerability as an issue that “may allow changes to Secure Boot settings by creating NVRAM variables.” Credited with discovering the flaw is ESET researcher Martin Smolár, who previously disclosed similar bugs in Lenovo computers.
Disabling Secure Boot, an integrity mechanism that guarantees that only trusted software is loaded during system startup, enables a malicious actor to tamper with boot loaders, leading to severe consequences.
This includes granting the attacker complete control over the operating system loading process as well as “disable or bypass protections to silently deploy their own payloads with the system privileges.”
Per the Slovak cybersecurity company, the flaw resides in a DXE driver called HQSwSmiDxe.
The BIOS update is expected to be released as part of a critical Windows update. Alternatively, users can download the fixes from Acer’s Support portal.
Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.
Related news
By Deeba Ahmed ESET assigned the vulnerability a CVSS score of 8.1 and tracked it as CVE-2022-4020. This is a post from HackRead.com Read the original post: Acer Laptop Vulnerability Allows Malware Infection During Secure Boot
The manufacturer is working to fix a vulnerability — similar to a previous problem in Lenovo laptops — that allows threat actors to modify or disable Secure Boot settings to load malware.
Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.