Microsoft-Signed Firmware Module Bypasses Secure Boot

Hackers could circumvent the protections of Secure Boot by silently disabling it through an attack that potentially affects a wide swath of Windows laptops and servers. The attack has limitations: Microsoft issued a patch this month and hackers would already need admin access and physical access to a target machine.

See Also: OnDemand | Protecting Devices and Software from Next-Generation Cyberthreats

The research nonetheless highlights a mounting parade of vulnerabilities in Unified Extensible Firmware Interface firmware, the industry standard for hardware initialization when a Windows or Linux computer powers up. Because UEFI runs before the operating system kicks in – and so before any OS-level security defenses load – it is a regular target for attackers (see: Researchers Spot Serious UEFI Secure Boot Bypass Flaw).

Researchers at Binarly said Tuesday they spotted on Virus Total last November a module for flashing bootup firmware apparently developed by a vendor of rugged displays in public areas such as airports. The module contained a flaw tracked as CVE-2025-3052 that stems from an UEFI memory corruption vulnerability. The module, armed with a Microsoft third-party certificate, allows an attacker to overwrite a key variable necessary for enforcing Secure Boot, the UEFI security feature meant to prevent malicious software from loading at the same level as the operation system.

Binarly researchers found the module reads the UEFI IhisiParamBuffer variable “and directly uses it as a pointer for multiple memory write operations, without performing any validation or sanity checks on its value.”

That allows an attacker to set the variable to any arbitrary address in memory, “effectively granting them an arbitrary memory write primitive,” wrote Binarly. The IhisiParamBuffer variable is stored in non-volatile RAM used to store variables that need to persist between boots. NVRAM variables are a recurrent source of security vulnerabilities. Documents published by WikiLeaks in 2017 detailing CIA penetration techniques leaked by former U.S. intelligence hacker Joshua Schulte showed the agency targeting NVRAM to take control over system booting (see: Breach Roundup: CIA Hacking Tool Leaker Gets 40 Years).

Some UEFI distributions are immune to this particular attack since they treat the IhisiParamBuffer variable as read-only. But the “vast majority of systems” are potentially at risk, Binarly wrote. Researchers also uncovered data that the module has possibly circulated online since October 2022.

When successfully executed, the operating system may still behave as if Secure Boot is enabled. When Binarly reported the flaw to Microsoft, the computing giant found an additional 13 firmware modules carried the same flaw. It revoked the Microsoft certificate for all 14 modules in the June Patch Tuesday dump of fixes.