Back to threat feeds
Vulnerability
Fatal UEFI Secure Boot Flaw (CVE-2024-7344) Exposes Millions to Hackers
A flaw exposing UEFI Secure Boot vulnerabilities. Learn how attackers exploit it and how to safeguard your systems now!
Continue reading
A flaw exposing UEFI Secure Boot vulnerabilities. Learn how attackers exploit it and how to safeguard your systems now!
Continue reading
Researchers have identified an exceptionally critical vulnerability, CVE-2024-7344, that undermines UEFI Secure Boot, a cornerstone security mechanism designed to ensure the integrity of the system boot process. This vulnerability enables malicious code execution during the boot sequence, even when Secure Boot is active, jeopardizing countless modern systems' security posture. The impacted systems span a broad spectrum of UEFI-based devices, significantly elevating the risks of deploying UEFI bootkits such as Bootkitty or BlackLotus.
The ramifications of this discovery are profound. Secure Boot, integral to protecting the boot chain, becomes ineffective when exploited, leading to unauthorized code execution. This raises severe security concerns across industries relying on UEFI-based devices, as attackers can compromise systems without triggering conventional security mechanisms.
The vulnerability emanates from a defective UEFI application, signed by Microsoft’s widely trusted Microsoft Corporation UEFI CA 2011 certificate. This enables attackers to circumvent Secure Boot by executing unsigned binaries during startup. The vulnerability affects multiple recovery software suites, including but not limited to:
The crux of the vulnerability lies in the usage of a custom PE loader, bypassing standard UEFI functions such as `LoadImage` and `StartImage`. This flawed implementation allows the execution of unsigned UEFI binaries from a specifically crafted file named `cloak.dat`, rendering Secure Boot policies ineffective.
Meticulous investigation revealed that the `cloak.dat` file, part of the vulnerable recovery software, contains an encrypted UEFI binary. Instead of leveraging UEFI’s integrity checks, the custom loader decrypts and executes the binary directly. The steps to exploit this vulnerability include:
The attack requires elevated privileges (e.g., local administrator rights on Windows or root access on Linux) but is feasible across systems trusting Microsoft’s third-party UEFI certificate.
UEFI Secure Boot ensures the integrity of the boot process by validating binaries against two key databases:
Most UEFI devices ship with Microsoft’s certificates preloaded to maintain compatibility with major operating systems. However, this reliance on Microsoft centralizes control over boot security, exposing potential systemic vulnerabilities when these certificates are compromised.
The responsible disclosure process ensured swift vendor responses and mitigation measures. Key milestones include:
This coordinated effort underscores the importance of collaboration between researchers, CERTs, and vendors in addressing security threats efficiently.
Users are strongly advised to update their systems with the latest UEFI revocations from Microsoft. Verification steps include:
Windows Systems:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft Corporation UEFI CA 2011'
[BitConverter]::ToString((Get-SecureBootUEFI dbx).bytes) -replace '-' -match 'cdb7c90d3ab8833d5324f5d8516d41fa990b9ca721fe643fffaef9057d9f9e48'Linux Systems:
dbxtool --list | grep 'cdb7c90d3ab8833d5324f5d8516d41fa990b9ca721fe643fffaef9057d9f9e48'CVE-2024-7344 exemplifies systemic vulnerabilities in the UEFI ecosystem, driven by opaque third-party signing processes. To enhance security, stakeholders must advocate for greater transparency and stringent review protocols in UEFI application signing. Microsoft’s upcoming UEFI certificate updates provide a pivotal opportunity to address these challenges.
For detailed inquiries, contact [email protected] or visit Threat Intelligence page.
Splunk disclosed CVE-2026-20253, a critical pre-auth RCE flaw in Splunk Enterprise (CVSS 9.8) from insecure MongoDB defaults. Patches released; upgrade to 9.1.8, 9.2.5, or 9.3.2.
