New UEFI Secure Boot Bypass Vulnerability Exposes Systems to Malicious Bootkits

A newly discovered vulnerability, CVE-2024-7344, has been identified as a critical flaw in the UEFI Secure Boot mechanism, potentially impacting the majority of UEFI-based systems.

This vulnerability, uncovered by researchers at ESET, allows attackers to bypass Secure Boot protections and execute untrusted code during the boot process, enabling the deployment of malicious UEFI bootkits like Bootkitty and BlackLotus. Alarmingly, this vulnerability affects systems even with Secure Boot enabled.

The flaw resides in a UEFI application signed with Microsoft’s “Microsoft Corporation UEFI CA 2011” third-party certificate. The vulnerability stems from the use of a custom PE loader instead of the standard and secure UEFI functions LoadImage and StartImage.

This oversight permits the loading of unsigned binaries from a specially crafted file named cloak.dat during system startup, bypassing Secure Boot integrity checks entirely.

Affected Software and Vendors

The vulnerable UEFI application is integrated into several real-time system recovery software suites developed by multiple vendors, including Howyar Technologies Inc., Greenware Technologies, Radix Technologies Ltd., SANFONG Inc., Wasay Software Technology Inc., Computer Education System Inc., and Signal Computer GmbH. The affected products include:

• Howyar SysReturn (versions before 10.2.023_20240919)
• Greenware GreenGuard (versions before 10.2.023-20240927)
• Radix SmartRecovery (versions before 11.2.023-20240927)
• Sanfong EZ-back System (versions before 10.3.024-20241127)
• WASAY eRecoveryRX (versions before 8.4.022-20241127)
• CES NeoImpact (versions before 10.1.024-20241127)
• SignalComputer HDD King (versions before 10.3.021-20241127).

UEFI Secure Boot verification ensures the integrity of boot applications like Windows Boot Manager, shim, or GRUB2 by checking them against two databases: the db, which lists allowed certificates or PE Authenticode hashes trusted by the platform firmware, and the dbx, which contains forbidden certificates or hashes.

A boot application must be trusted by the db and not listed in the dbx for the UEFI Boot Manager to execute it; otherwise, a security violation occurs.

Exploitation of CVE-2024-7344 enables attackers to replace legitimate bootloader binaries with malicious ones on the EFI System Partition (ESP), reads the ESET report.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

This allows unsigned code to execute during the early boot phase, granting attackers persistent access to the system while evading detection by operating system-level security tools such as endpoint detection and response (EDR) solutions.

Elevated privileges such as local administrator rights on Windows or root access on Linux—are required to deploy malicious files to the ESP.

ESET reported the vulnerability to the CERT Coordination Center (CERT/CC) in June 2024, leading to coordinated efforts with affected vendors to address the issue. Microsoft revoked vulnerable binaries as part of its January 14, 2025 Patch Tuesday update.

Users are advised to update their systems promptly by applying the latest UEFI revocations provided by Microsoft or their respective operating system vendors.

For Windows users, updates should be automatically applied through Windows Update. Linux users can obtain updates via the Linux Vendor Firmware Service.

This incident highlights broader concerns about third-party UEFI software security practices and Microsoft’s code-signing process for UEFI applications.

The discovery of such an “obviously unsafe” signed binary raises questions about how many other vulnerable bootloaders might exist undetected in third-party software.

ESET researchers have called for greater transparency in Microsoft’s review process for signing third-party UEFI applications to prevent similar vulnerabilities in the future.

To protect against potential exploitation:

1. Apply all available updates for affected recovery software.
2. Ensure that your system’s Secure Boot Forbidden Signature Database (DBX) is up-to-date.
3. Regularly audit UEFI configurations for unauthorized changes.

While no real-world exploitation attempts have been detected so far, experts warn that vulnerabilities like CVE-2024-7344 could be weaponized by sophisticated threat actors if left unpatched.

This discovery underscores the importance of robust firmware security practices and timely patch management in safeguarding critical systems against emerging threats.

Integrating Application Security into Your CI/CD Workflows Using Jenkins & Jira -> Free Webinar