Research on fuzzing techniques for UEFI firmware Double-fetch race condition vulnerability
Yin Jiawei 1,2，Shi Ji 1，Zhang Yu1，Dai Ge 1，Wang Chen 1，Zhan Lanlan 1
1. Academy of Cyber; 2. Institute of Information Engineering, Chinese Academy of Sciences
Abstract： The firmware implemented based on the Unified Extensible Firmware Interface (UEFI) standard has been widely adopted in personal computers, cloud servers, and network equipment. Vulnerabilities in UEFI firmware services can pose severe security threats. Fuzzing testing serves as a primary method for vulnerability detection. However, constrained by traditional memory vulnerability mechanisms, current UEFI firmware fuzzing approaches fail to detect special-type vulnerabilities such as Double-fetch race condition vulnerabilities in UEFI firmware. This paper proposes a Double-fetch-aware fuzzing methodology for UEFI firmware services and implements a prototype system named UEFIDFFuzzer. Through testing 114 UEFI firmware service drivers from Intel-based vendors, UEFIDFFuzzer successfully identified two previously undetected UEFI firmware Double-fetch zero-day vulnerabilities that existing UEFI fuzzing tools (RSFuzzer) and static analysis tools (efiXplorer) had missed.
Key words : UEFI; Double-fetch vulnerability; fuzzing
