Intel has released a security bulletin with 16 newly discovered BIOS-related vulnerabilities that allow attackers to use Denial of Service and Escalation of Privilege attacks on a local machine, at the same time bypassing the operating system and its associated security measures. According to Intel, these issues only impact "some" Intel processors, but it doesn't name which CPUs.

These are brand new vulnerabilities that are not related to the recently announced Intel/AMD vulnerabilities, nor are they related to HP, Dell, Lenovo, and other vendors . Nonetheless, these 16 new vulnerabilities are similar to some of those other vulnerabilities in the fact that the issue is BIOS-related. All 16 allow attackers to hijack the BIOS of a computer in order to gain access to the local machine, thereby accessing sensitive data.

Thankfully, Intel does note that all these issues can only be exploited if the attacker has physical access to the machine and cannot be manipulated remotely. For businesses that have secure locations, these vulnerabilities shouldn't be as big of a concern as for people with personal laptops where anyone could grab them when you aren't looking.

The issues specifically rely on an assortment of bugs found in Intel's BIOS firmware, including insufficient control flow management, buffer overflow, pointer issues, improper validation, and more. All of these allow attackers to escalate privileges when needed. Others include improper access control and incorrect default permissions that can allow attackers to use denial of service attacks against the local machine.

Most of these BIOS-related vulnerabilities are very impactful as they can effectively bypass nearly all security measures on a local PC. Most security measures run as part of the operating system, or on top of the OS, which only loads after the BIOS runs its initial POST (Power-On Self-Test). This means all regular security countermeasures are unable to protect the system BIOS.

Intel has yet to release a formal roadmap or estimated deadline as to when these vulnerabilities will be patched. But with how serious most of these vulnerabilities are, we at least know that fixing them should be on the top of Intel's priority queue.