Skip to main content

Intel Alder Lake BIOS source code was leaked — should you be worried?

It’s official — the source code for the Intel Alder Lake BIOS was leaked, and Intel has confirmed it. A total of 6GB of code used for building the BIOS/UEFI source code is now out in the wild, having been posted on GitHub and 4chan.

Intel doesn’t seem too concerned, but security researchers are now hard at work trying to see if this can be used in a malicious way. If you own an Alder Lake CPU, should you be worried?

I can't believe: NDA-ed MSRs, for the newest CPU, what a good day… pic.twitter.com/bNitVJlkkL

— Mark Ermolov (@_markel___) October 8, 2022

News of the leak broke out a couple of days ago when the code was found in a public GitHub repository, as well as shared on 4chan. The 6GB file contains some of the tools and code that Intel has used to build the BIOS/UEFI in its Alder Lake CPUs. Seeing as these are some of the best processors out currently, this could potentially put a lot of Intel’s customers at risk.

The BIOS/UEFI source code is responsible for initializing the hardware even before the operating system has the chance to load. As such, it’s responsible for establishing secure connections to important mechanisms within the computer, such as the Trusted Platform Module (TPM). The BIOS plays an important role in any computer, so it’s certainly not good that the source code for it could now be in the hands of nefarious threat actors.

Initially, it was uncertain whether the leaked file was the real deal, but Intel itself has now confirmed that to be the case. In a statement issued to Tom’s Hardware, Intel said:

“Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them to our attention through this program. We are reaching out to both customers and the security research community to keep them informed of this situation.”

Intel’s statement implies that the most sensitive data had already been scrubbed from the source code before it was released to external partners. The source code contains many references to Lenovo, including “Lenovo String Service,” “Lenovo Cloud Service,” and “Lenovo Secure Suite.” Bleeping Computer notes that all of the code was developed by Insyde Software Corp.

An Intel Alder Lake Core i5-12600K CPU and its packaging.
Jacob Roach / Digital Trends

While this leak sounds pretty bad, Intel doesn’t seem to be overly concerned — although it’s good that it refers everyone to its bug bounty program. Many security researchers are already looking for cracks in the code, and some of the findings are less optimistic.

Hardware security firm Hardened Vault told Bleeping Computer: “The attacker/bug hunter can hugely benefit from the leaks even if leaked [manufacturer] implementation is only partially used in the production. The Insyde’s solution can help the security researchers, bug hunters, (and the attackers) find the vulnerability and understand the result of reverse engineering easily, which adds up to the long-term high risk to the users.”

Seeing as a KeyManifest private encryption key was found in the leak, it’s possible that hackers could use it to bypass Intel’s hardware security. Even so, it’s still a fairly long shot, so you probably don’t have to be too worried.

In any case, it’s worth it to keep yourself safe with some antivirus software to ensure that no attackers can access your computer, and subsequently, the BIOS.

Editors' Recommendations

Monica J. White
Monica is a UK-based freelance writer and self-proclaimed geek. A firm believer in the "PC building is just like expensive…
Intel just accidentally leaked a mysterious 34-core CPU
Intel's CEO holding a Raptor Lake processor.

A mysterious wafer full of Intel Raptor Lake-S processors was spotted during Intel Innovation 2022. While that in itself may not sound odd, the weird part is that the wafer contains 34-core chips that are labeled as Raptor Lake, whereas Intel's new flagship Core i9-13900K maxes out at 24 cores.

Is Intel hiding an even more powerful processor? That'd be nice, but all signs point to it being something else entirely -- a Sapphire Rapids chip.

Read more
Why it’s hard recommending AMD Ryzen 7000 after Intel’s Raptor Lake launch
The Ryzen 9 7950X socketed into a motherboard.

AMD's Ryzen 9 7950X is the best processor I've tested -- and it's not even close. That might surprise you to find out considering I don't recommend upgrading right now.

Although Ryzen 7000 is a massive boost for AMD, high prices, limited options for gamers, and Intel's looming Raptor Lake launch makes right now the worst time to upgrade. Team Red may win the decades-old battle between AMD and Intel this generation, but it's still too soon to tell. And there's no rush to upgrade now.
Raptor Lake looms

Read more
Intel CEO on high GPU prices: ‘You should be frustrated’
Intel CEO Pat Gelsinger presenting Arc Alchemist GPUs.

Intel finally put a date on its Arc Alchemist graphics cards during its Innovation 2022 event. The flagship A770 is releasing on October 12, but that's not the most interesting part of the announcement. The card is only $330, and Intel says that's a very intentional price point.

Before announcing the release date, Intel CEO Pat Gelsinger had a clear message on high GPU prices: "You should be frustrated." The executive showed how the cost of GPUs has risen significantly over the past few years, and said the A770 looks to break that trend. "[GPUs] have just gotten super expensive, and we don't think they need to," Gelsinger added.

Read more