News of the alleged leak is coming out through Twitter posts from vxunderground, and another Twitter user @glowingfreak tweeted the GitHub link containing the copy of the leaked source code. Based on the files, it looks like the data and files are mostly related to BIOS and chipsets.
Intel's Alder Lake CPUs were released last year on the 4th of November, 2021, and the leaked data include 2.8 GB worth of compressed source code and 5.86GB when unzipped
It's unclear where the leakers got the files from, and the reason behind the leaks. Another question arises, does the leak of the code is due to hacking? If so then Intel was hacked or some other vendor such as a major OEM since there are documents on the leak that refer to Lenovo's "Feature Tag Test Information".
In the meantime, these documents cannot prove whether they contain sensitive files, and it is not clear whether they will be used for vulnerability development.
It is worth mentioning that most motherboard vendors and OEMs have similar tools and information at their disposal to create firmware for Intel platforms, and Intel is likely to clean up any overly sensitive material before passing it on to third-party vendors. However, confidential material is never good in the hands of nefarious actors, and small pieces of information can generate large vulnerabilities.
Intel Confirm the leaked code with a statement
Intel has confirmed that a source code leak for the UEFI BIOS of Alder Lake CPUs is authentic, and is its proprietary UEFI code. The statement from Intel reads-
"Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on the obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them to our attention through this program. We are reaching out to both customers and the security research community to keep them informed of this situation." — Intel spokesperson.
However, Intel has downplayed the security risk of the source code leak, but security researcher warns that the contents could make it easier to find vulnerabilities in the code.
One security researcher Mark Ermolov has already shown his work after digging into the leaked source code. On his Twitter post, he shows that he has found secret MSRs (Model Specific Registers) that are typically reserved for privileged code and thus can present a security problem, along with the private signing key used for Intel's Boot Guard, thus potentially invalidating the feature. In addition, there are also signs of ACMs (Authenticated Code Modules) for BootGuard and TXT (Trusted Execution Technology), portending potential future issues with the root of trust.
This is not the first hack of its kind as NVIDIA, AMD, and Gigabyte have all been hacked in recent times. NVIDIA was hacked in early 2022 by the hacking group LAPSU$, resulting in the theft of more than 1TB of its data, including some documents and source code for future technologies.