Earlier this month computer manufacturer Lenovo released a security update for a wide range of its laptop and desktop systems.
The security update affects the Lenovo Service Engine (LSE). This is a utility created by Lenovo that becomes part of the computers BIOS (see Aside below for a definition) that downloads an application known as OneKey Optimizer. This application downloads updates for the computer’s BIOS, drivers updates for hardware and installs applications that are usually pre-installed when the computer leaves the Lenovo factory. Finally the application also sends non-personally identifiable system data to Lenovo servers.
As explained by Lenovo in their security advisory (see links provided below) in collaboration with an independent security researcher and Microsoft security vulnerabilities were found in the LSE (which included a buffer overflow attack (see Aside 2 below for a definition) and an attempted connection to a Lenovo test server). The LSE used the Microsoft Windows Platform Binary Table (WPBT). Microsoft has since provided updated security guidelines for using this capability of Windows. Since the LSE no longer meets those guidelines, Lenovo has chosen to remove all components of the LSE from the affected Lenovo systems.
Why Should These Issues Be Considered Important?
According to the US-CERT, the flaws within the LSE could allow a remote attacker to take control of the Lenovo system.
How Can I Protect Myself From These Issues?
As recommended by Lenovo in their advisories for laptops and desktop systems (both advisories are different), please update the BIOS of the affected systems using the steps provided in those advisories. Once updated the LSE disabler tool can be used to remove the vulnerable LSE components.
What is a BIOS?
A Basic Input/Output System (BIOS) is the first piece of code that tells your computer what to do when it is first turned on. This involves 2 stages, the first stage involves a quick diagnostic of the computers components known as a power on self-test (POST).
The second stage involves brining your computer into a usable state by starting your operating system e.g. Linux, Mac OS X or Windows from the first bootable hard drive (or other drive) it locates.
The BIOS will also check for other bootable devices such as CDs/DVDs or USB jump drives. The goal being to find the next stage of the start-up process whether that be the much more common task of starting your operating system so that you can get to work or allowing you to repair the computer or recover your data using emergency bootable discs/USB jump drives. Further information on computer BIOSes and how they are migrating to the newer Unified Extensible Firmware Interface (UEFI) architecture is available here.
What is a Buffer Overflow attack?
A buffer is an area of computer memory set aside for a specific task. If data larger than that area is (attempted) to be stored in that area, that buffer will overflow. When an overflow happens the data that can fit in the buffer is stored in that buffer while the data that doesn’t fit spills over into memory adjacent to that buffer. Whatever data is stored in those locations is overwritten.
Within the overfilled memory areas (which now contain unintended data (from the point of view of another programs assuming they still contain valid data)) may have previously been another buffer, a programs data output or a pointer (defined below) to another area of memory.
At best this will result in the program using that value (that was overwritten) crashing or getting caught in an infinite loop (performing the same action again and again without ending). At worst, an attack could use a buffer overflow to their advantage.
This can result in an attacker being able to run/execute code of their choice by overwriting the return pointer of the program (due to the overflow that has happened) with a value of the attackers choosing. That value is placed there by the overspill into adjacent memory segments. When an operation is completed, instead of the program returning (using the location the return pointer is referencing) to the place where it was originally asked (called from) the program will instead go to the place in memory where the attacker has stored malicious code (since the attacker supplied this location by inserting a value of their choice (which is too large to fit in the buffer) as mentioned above).
A pointer is a variable (a segment of memory that stores a single value) that contains the address (in computer memory) of another variable.
The attacker’s code can then run with same privileges of the program which suffered the overflow. C and C++ functions (a set of instructions that carries out a specific action within a program) such as strcpy (string copy) and strcat(string concatenation/appending function) are just some examples of functions that are vulnerable to buffer overflows.
Such unsafe functions were replaced with functions that carried out the same task but checked the size of the input against the size of the buffer it was to be stored in and don’t allow an overflow to occur. These safe functions are now recommended by Microsoft. To enforce the use of safe functions the Banned Function Calls header file was created (also documented here). Other mitigations such as /GS cookies (discussed in a previous blog post) were also implemented to protect against buffer overflows.
Please note that it is only Microsoft that uses the newer safer functions mentioned above. Linux takes a different approach as does Apple but each results in safer code.
Update: 7th September 2015:
While the use of “safe” versions of common functions that operate on buffers are the preferred method of working with buffers, they are not perfect since they can suffer from incorrect calculations of the width of the buffer to allocate. If a mistake is made here by the programmer, a buffer overflow can still result. An example of a protected version of such a function (of the strcpy() function mentioned above) can be seen in the function declaration shown below that takes the width of the desired buffer as parameter would be:
strncpy(destination, source, width);
The above function declaration shows the name of the “safe” function, namely strncpy (notice the difference to the standard function with the name of strcpy, the “safe” function includes an extra “n”). The 3 parameters to this function are shown within the parentheses () otherwise known as brackets.
Update: 17th September 2015:
A detailed definition of a stack overflow is provided in a more recent blog post. This similar type of overflow can be a useful addition to the above explanation. Thank you.
A further reference for buffer overflow attacks is the following:
Smashing The Stack For Fun And Profit by Aleph One