CVE-2025-3052

Research on CVE-2025-3052, an Insyde firmware vulnerability that exposes an arbitrary write primitive capable of modifying security-critical pointers.

• The UEFI application retrieves the value of the IhisiParamBuffer NVRAM variable.
• This value is treated as a trusted pointer and stored in a global variable at address 0xf7a0.
• The code subsequently performs a memory write operation at global + 0x18, setting that address to zero.
• Additional write operations follow, all derived from the same attacker-controlled NVRAM value.
• No bounds checking, sanity validation, or access control is applied at any point.

As a result, an attacker who can control the IhisiParamBuffer variable gains the ability to influence where in memory these writes occur. While the write primitive is somewhat constrained, typically allowing writes of zero or small constants to an arbitrary address, it is still powerful enough to corrupt critical firmware state.

In Binarly's proof of concept, the attack targets the global variable gSecurity2, which holds a pointer to the Security2 Architectural Protocol (for a detailed explanation of this specific exploitation technique, refer to the following repository "TheMalwareGuardian: Exploitation Technique SecureBoot Bypass gSecurity2 Corruption"). This protocol is consulted by the LoadImage service to enforce Secure Boot policy, meaning that overwriting gSecurity2 with a null pointer effectively disables Secure Boot checks at runtime. Crucially, this bypass is transparent to the operating system: once booted, Secure Boot still appears enabled at the OS level even though it has been fully neutralized at the firmware level.

An important nuance is that on Insyde-based platforms, the IhisiParamBuffer variable is typically locked as read-only, which effectively prevents exploitation on those systems without an additional vulnerability. Ironically, this means the vendor whose IBV introduced the vulnerable variable pattern in the first place is among the least exposed, while all other platforms remain at risk. For cases where the variable is locked, a bypass such as BRLY-2023-005 can be chained to gain write access to the variable before proceeding with exploitation. On systems where the variable is directly writable, the attack is straightforward and highly reliable.