Researchers Spot Serious UEFI Secure Boot Bypass Flaw

Microsoft has patched a vulnerability present in majority of Unified Extensible Firmware Interface systems, which attackers could exploit to run malicious code during the boot process, prior to Windows loading.

See Also: Cyber Hygiene and Asset Management Perception vs. Reality

The vulnerability, tracked as CVE-2024-7344, is present in multiple real-time system recovery tools but could be used by attackers to target any Windows or Linux system, even if it doesn’t run a tool that uses the vulnerable driver.

“An attacker who can successfully exploit this vulnerability could bypass Secure Boot,” Microsoft said in a security advisory. The technology giant patched the flaw Tuesday by issuing updates for every supported operating system that revoked the vulnerable driver. Updates for Linux systems, which are also at risk, are available through the Linux Vendor Firmware Service.

Researchers at cybersecurity firm Eset, who discovered the flaw, recommend all organizations immediately apply the updates – or the mitigations they’ve detailed – and verify that the revocations have taken place. They said the risk posed by the vulnerability is significant, “as attackers can bring their own copy of the vulnerable binary to any UEFI system with the Microsoft third-party UEFI certificate enrolled” and use it to install a bootkit such as BlackLotus or Bootkitty that can take full control of the underlying system.

Eset reported the flaw to the CERT Coordination Center in the U.S. in June 2024. CERT/CC coordinated a fix with affected vendors: Computer Education System, Howyar Technologies, Greenware Technologies, Radix Technologies, SANFONG, Signal Computer and Wasay Software Technology.

UEFI is an industry standard for hardware initialization when a computer powers up, published by the UEFI Forum. The interface, successor to the less secure Basic Input/Output System, or BIOS, is a critical part of the boot process for Windows and many Linux distributions. It handles startup functions by interfacing between the computer firmware and operating system. In effect, UEFI is a mini-operating system of its own. Because UEFI runs before Windows or Linux and thus before any OS-level security defenses load, it remains a regular target for attackers.

Eset traced the now patched vulnerability to an application that uses a custom-built Windows PE – for preinstallation environment – format file loader, rather than using “standard and secure UEFI functions LoadImage and StartImage.”

Any UEFI system that has Microsoft third-party UEFI Secure Boot enabled, as well as its “Allow Microsoft 3rd Party UEFI CA” setting enabled, is at risk. Eset said that Windows 11 Secured-core PCs should have the latter option disabled by default.

The vulnerable UEFI driver was signed by Microsoft’s “Microsoft Corporation UEFI CA 2011” third-party UEFI certificate.

The vulnerability could be exploited to defeat UEFI Secure Boot – meant to ensure that the boot process only proceeds with software that’s correctly signed by the hardware manufacturer – and allow attackers to install a malicious UEFI bootkit.

While UEFI and UEFI Secure Boot are intended to provide security, their efficacy shouldn’t be taken as a given, said Martin Smolár, the Eset researcher who discovered the vulnerability (see: US CISA Urges Improvements to Key Computer Component).

“What concerns us the most with respect to the vulnerability is not the time it took to fix and revoke the binary – which was quite good compared to similar cases – but the fact that this isn’t the first time that such an obviously unsafe, signed UEFI binary has been discovered,” he said. “This raises questions of how common the use of such unsafe techniques is among third-party UEFI software vendors, and how many other similar obscure, but signed, bootloaders there might be out there.”

As just one example, he said CVE-2024-7344 strongly resembles other vulnerabilities – CVE-2022-34301, CVE-2022-34302 and CVE-2022-34303 – discovered and detailed in August 2022 by cybersecurity supply chain risk management firm Eclypsium. All involved vulnerable bootloaders were “signed by the Microsoft UEFI Third-Party Certificate Authority,” which made them trusted by default for almost all Windows and Linux systems, Eclypsium said at the time.