Vulnerability Note VU#976132

UEFI implementations do not properly secure the EFI S3 Resume Boot Path boot script

Original Release date: 05 Jan 2015 | Last revised: 03 Aug 2015


Some UEFI systems fail to properly restrict access to the boot script used by the EFI S3 Resume Boot Path, allowing an authenticated, local attacker to bypass various firmware write protections.


According to Rafal Wojtczuk of Bromium and Corey Kallenberg of The MITRE Corporation:

"During the UEFI S3 Resume path, a boot script is interpreted to re-initialize the platform. The boot script dictates various memory and port read/write operations to facilitate this re-initialization. The boot script is interpreted early enough where important platform security mechanisms have not yet been configured. For example, BIOS_CNTL, which helps protects the platform firmware against arbitrary writes, is unlocked. TSEGMB, which protects SMRAM against DMA, is also unlocked.

Given this, the boot script is in a security critical position and maintaining its integrity is important. However, we have discovered that on certain systems the boot script resides in unprotected memory which can be tampered with by an attacker with access to physical memory."


An authenticated local attacker may be able to bypass Secure Boot and/or perform an arbitrary reflash of the platform firmware despite the presence of signed firmware update enforcement. Additionally, the attacker could arbitrarily read or write to the SMRAM region. Lastly, the attacker could corrupt the platform firmware and cause the system to become inoperable.


Please see the Vendor Information section below to determine if your system may be affected. We are continuing to communicate with vendors as they investigate these vulnerabilities.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
American Megatrends Incorporated (AMI)Affected15 Sep 201410 Dec 2014
AppleAffected23 Jul 201530 Jul 2015
Dell Computer Corporation, Inc.Affected15 Sep 201403 Aug 2015
Insyde Software CorporationAffected-03 Feb 2015
Intel CorporationAffected15 Sep 201420 Jul 2015
LenovoAffected-21 Jan 2015
Phoenix Technologies Ltd.Affected06 Oct 201419 Dec 2014
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C
Temporal 5.6 E:POC/RL:ND/RC:C
Environmental 5.6 CDP:ND/TD:H/CR:ND/IR:ND/AR:ND



Thanks to Rafal Wojtczuk and Corey Kallenberg for reporting this vulnerability, as well as Intel Advanced Threat Research.

This document was written by Todd Lewellen.

Other Information

  • CVE IDs: CVE-2014-8274
  • Date Public: 28 Dec 2014
  • Date First Published: 05 Jan 2015
  • Date Last Updated: 03 Aug 2015
  • Document Revision: 31


If you have feedback, comments, or additional information about this vulnerability, please send us email.