Skip to main content

Intel Alder Lake BIOS source code was leaked — should you be worried?

It’s official — the source code for the Intel Alder Lake BIOS was leaked, and Intel has confirmed it. A total of 6GB of code used for building the BIOS/UEFI source code is now out in the wild, having been posted on GitHub and 4chan.

Intel doesn’t seem too concerned, but security researchers are now hard at work trying to see if this can be used in a malicious way. If you own an Alder Lake CPU, should you be worried?

I can't believe: NDA-ed MSRs, for the newest CPU, what a good day…

— Mark Ermolov (@_markel___) October 8, 2022

News of the leak broke out a couple of days ago when the code was found in a public GitHub repository, as well as shared on 4chan. The 6GB file contains some of the tools and code that Intel has used to build the BIOS/UEFI in its Alder Lake CPUs. Seeing as these are some of the best processors out currently, this could potentially put a lot of Intel’s customers at risk.

The BIOS/UEFI source code is responsible for initializing the hardware even before the operating system has the chance to load. As such, it’s responsible for establishing secure connections to important mechanisms within the computer, such as the Trusted Platform Module (TPM). The BIOS plays an important role in any computer, so it’s certainly not good that the source code for it could now be in the hands of nefarious threat actors.

Initially, it was uncertain whether the leaked file was the real deal, but Intel itself has now confirmed that to be the case. In a statement issued to Tom’s Hardware, Intel said:

“Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them to our attention through this program. We are reaching out to both customers and the security research community to keep them informed of this situation.”

Intel’s statement implies that the most sensitive data had already been scrubbed from the source code before it was released to external partners. The source code contains many references to Lenovo, including “Lenovo String Service,” “Lenovo Cloud Service,” and “Lenovo Secure Suite.” Bleeping Computer notes that all of the code was developed by Insyde Software Corp.

An Intel Alder Lake Core i5-12600K CPU and its packaging.
Jacob Roach / Digital Trends

While this leak sounds pretty bad, Intel doesn’t seem to be overly concerned — although it’s good that it refers everyone to its bug bounty program. Many security researchers are already looking for cracks in the code, and some of the findings are less optimistic.

Hardware security firm Hardened Vault told Bleeping Computer: “The attacker/bug hunter can hugely benefit from the leaks even if leaked [manufacturer] implementation is only partially used in the production. The Insyde’s solution can help the security researchers, bug hunters, (and the attackers) find the vulnerability and understand the result of reverse engineering easily, which adds up to the long-term high risk to the users.”

Seeing as a KeyManifest private encryption key was found in the leak, it’s possible that hackers could use it to bypass Intel’s hardware security. Even so, it’s still a fairly long shot, so you probably don’t have to be too worried.

In any case, it’s worth it to keep yourself safe with some antivirus software to ensure that no attackers can access your computer, and subsequently, the BIOS.

Monica J. White
Monica is a UK-based freelance writer and self-proclaimed geek. A firm believer in the "PC building is just like expensive…
Intel 14th-gen Meteor Lake: architecture, specs, and performance
On-package memory on Intel Meteor Lake processors.

Intel's 14th-gen Meteor Lake processors are here, and they're ready to compete against some of the best processors for laptops. While they don't currently -- and may never -- have desktop counterparts, Meteor Lake chips bring improved graphics performance, AI capabilities, and high core counts to thin and light laptops.

What's new in Meteor Lake, and what will these CPUs excel at? With Intel's announcement, we now know the answers to those questions.
Pricing and release date

Read more
Some surprising details on Intel’s upcoming 14th-gen laptops just leaked
Intel's new Intel Core Ultra badge.

One of the first laptops powered by Intel’s upcoming 14th-gen Meteor Lake CPUs has been spotted online, and based on what we're seeing, the prices look surprisingly affordable.

The information originated on X (formerly Twitter) from @momomo_us, who initially shared details about these new laptops via Newegg US. The post disclosed information about the expected CPUs and key specifications of the laptops. Among MSI's lineup of work laptops featuring Meteor Lake CPUs, the Prestige 13 and 16 are the first ones identified. The leak also mentions the CreatorPro 16 Studio, as well as popular gaming SKUs, the Stealth 14 and 16, although specs for these were not provided.

Read more
Intel may have accidentally leaked the release date for Windows 12
Someone typing on the Surface Laptop Studio 2's touchscreen.

Did we just get a confirmation about the release time frame for Windows 12 -- and from Intel, of all sources? It seems that way. Intel spoke about its predictions for 2024, indicating that it expects 2024 to be a good year for client processors. That's huge for Intel because the next generation of its top processors, Meteor Lake, is set to come out in 2024. However, if Intel is right, it might be a big year for Microsoft, too.

The information comes from a transcript of the Citi 2023 Global Technology Conference. Most of it wasn't too exciting -- fireside chats aren't often that interesting to the masses -- but there's a little comment in there that piqued our interest.

Read more