Intel Alder Lake UEFI source code leaked by a third party

Intel confirmed the leak and is reaching out to customers and the security community to "keep them informed."

Intel said a third party leaked its proprietary source code for the UEFI/BIOS of Alder Lake.

Alder Lake is Intel's 12th generation of Intel Core processors. A threat actor leaked the source code for its BIOS/UEFI firmware, acting as an interface between the computer's hardware and the operating system, in a 4chan post.

The post containing a link to a GitHub repository was taken down but allegedly has already been replicated. It currently remains unclear who was responsible for the leak or how exactly he managed to exfiltrate the code.

"An unidentified user uploaded the Insyde's partial firmware solution (4.8GB) only for the Intel Alder Lake platform, which contains Intel reference implementation, OEM implementation, IBV [Independent BIOS Vendor] solution, and related documentation on September 30, 2022," cybersecurity company Hardened Vault said in an analysis of the leak.

The company said an attacker/bug hunter could hugely benefit from the leaks even if OEM implementation is only partially used in the production.

"The Insyde's solution can help the security researchers, bug hunters (and the attackers) find the vulnerability and understand the result of reverse engineering easily, which adds up to the long-term high risk to the users," Hardened Vault said.

Intel confirmed the leak, saying its "proprietary UEFI code appears to have been leaked by a third party."

"We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them our attention through this program. We are reaching out to both customers and the security research community to keep them informed of this situation," Intel's comment distributed to media outlets on-demand reads.