> TLDR: A BIOS firmware bug in Intel NUC 11 Compute Elements (before EBTGL357.0065) can let an attacker with local privileges escalate their authority. This post explains the vulnerability, shares code snippets, and links to resources you need to know.

What Is CVE-2022-38099?

CVE-2022-38099 is a security vulnerability in the BIOS firmware for certain Intel(R) NUC 11 Compute Elements, discovered before EBTGL357.0065. The flaw is classified as improper input validation—meaning some firmware routines accept input they shouldn’t, letting a local privileged user potentially escalate their privileges (e.g., become SYSTEM or perform BIOS-level tampering).

Official Intel Advisory

Read Intel's own security advisory here:  
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00712.html

Technical Details: How Does BIOS Input Validation Get Wrong?

Input validation in BIOS is vital—it checks if values submitted to firmware features or SMM (System Management Mode) handlers are safe and "make sense." If not, an attacker can pass strange or malicious data, possibly corrupting memory or misdirecting control flow.

For CVE-2022-38099, specific firmware interfaces didn’t properly validate inputs. A local attacker with administrator access could send crafted requests to the UEFI firmware features (possibly via SMI handlers), causing unintended code execution with BIOS/firmware privilege.

Attacker gets local admin or SYSTEM rights.

2. Attacker sends malformed data to certain UEFI functions via Windows kernel drivers, tools like CHIPSEC, or custom code.
3. Firmware mishandles the data due to weak validation, potentially letting attacker run code or change firmware settings at a very high privilege level.

Note: This doesn’t work remotely or for normal users—admin/root access is required!

Code Snippet: Simulating the Exploit

The following code snippet shows how a local attacker (with admin) might trigger vulnerable BIOS SMI handlers using Python and the CHIPSEC framework, which allows low-level access to platform firmware. (Don't try this on devices you care about.)

# REQUIRE: Run as Administrator on affected Intel NUC 11 *before* EBTGL357.0065
import chipsec
from chipsec.hal import spi

# Initialize CHIPSEC framework
ch = chipsec.chipset()
ch.init(None)

# Try sending invalid input to a hypothetical SMI handler
malformed_data = b'\xAA' * 128  # Malicious payload of 128 bytes

# Hypothetical SMI trigger (Not real offsets! For illustration)
smi_command = xDE  # Usually SMI commands are xB2 or similar
smi_data_port = xB3

# Write data to SMI (could trigger improper input validation)
spi.write_SPI(smi_data_port, malformed_data)

print("[!] Sent malformed data to SMI handler – check for escalation opportunities.")

How does this work?

Above, an attacker sends a sequence of bytes to a BIOS SMI handler with no proper sanity checking. If the handler takes this at face value, system security could be bypassed, leading to, say, firmware corruption or hidden backdoors.

Warning: Exploiting firmware can permanently brick hardware!

How Bad Is This Vulnerability?

- Yes, you need local admin—but this is common in post-exploitation attacks (where malware has already breached user-level accounts).
- Privilege escalation to BIOS means "God mode". Attackers could bypass secure boot, plant stealth malware, or lock out defenders.

How Do You Fix or Mitigate It?

1. Update your BIOS! Intel fixed this in version EBTGL357.0065 and after. Download from the official Intel site:  
  https://www.intel.com/content/www/us/en/products/docs/boards-kits/nuc/elements/nuc-11-compute-element.html

More Resources

- Intel Security Advisory for CVE-2022-38099
- NIST National Vulnerability Database: CVE-2022-38099
- CHIPSEC – Platform Security Assessment Framework

Final Thoughts

CVE-2022-38099 shows how “just admin” on endpoints isn’t always the end—malware and redteamers can reach the hardware layer. Always patch firmware, don’t trust even signed executables blindly, and audibly review what your system can do as "admin". Firmware bugs don’t make headlines, but as you see, they can hand over the keys to your entire device.

Timeline

Published on: 11/11/2022 16:15:00 UTC
Last modified on: 11/16/2022 17:00:00 UTC