On March 12, 2024, Microsoft patched a critical security hole labeled CVE-2024-28923. This flaw affects Secure Boot, a core Windows technology designed to ensure the authenticity and integrity of boot components before the operating system loads. Attackers exploiting this vulnerability could bypass Secure Boot entirely, paving the way for malware or unauthorized operating systems to run silently at boot time.

In this post, I’ll break down CVE-2024-28923, show a simple proof-of-concept (PoC), link to original references, and explain what you should do next — all in plain English.

What Is Secure Boot & Why Does It Matter?

Secure Boot is a UEFI-based security feature designed to stop rogue bootloaders or malicious operating systems from loading before Windows starts up. It checks cryptographic signatures on bootloader files and drivers to only allow approved components. If someone can trick Secure Boot, they could run practically anything before Windows even wakes up — “rootkit paradise.”

What Is CVE-2024-28923?

CVE-2024-28923 is a Secure Boot Security Feature Bypass vulnerability. According to Microsoft’s bulletin:

> *An attacker who successfully exploited this vulnerability could bypass Secure Boot, allowing them to load untrusted software in the boot process.*

Here's what this means in real life

- The attacker needs either physical access to your computer or admin rights (often through some other malware).

Because of CVE-2024-28923, Secure Boot doesn’t detect the trick.

- Next time you boot, the attacker’s software loads in place of the legit bootloader — they control the system below the operating system.

How Is The Exploit Possible? (The Technical Angle)

The vulnerability arises from the Boot Manager’s improper validation of certain policy or security settings in UEFI variables or bootloader files. An attacker can craft a malicious bootloader or tweak existing files to slip past Secure Boot checks.

Prepare a Custom Bootloader

- Download the legitimate bootmgfw.efi (Windows Boot Manager) and patch it using UEFI dev tools so its signature or footprint bypasses Secure Boot verification.

Replace the Original File

- On the EFI partition (usually hidden and mounted at \EFI\Microsoft\Boot\), overwrite bootmgfw.efi with your customized copy.

Tweak Secure Boot Variables (optional)

- Use tools like efivar on Linux, or bcdedit on Windows, to modify Secure Boot variables or policies to assist the bypass.

Example: Overwriting Bootloader (on Linux)

# WARNING: FOR EDUCATIONAL PURPOSES ONLY

# Mount EFI partition
sudo mkdir /mnt/efipart
sudo mount /dev/sda1 /mnt/efipart

# Replace Boot Manager with malicious one
sudo cp custom_bootmgfw.efi /mnt/efipart/EFI/Microsoft/Boot/bootmgfw.efi

# Unmount when done
sudo umount /mnt/efipart

Now, on next startup, the system will launch the attacker's version. If they added, say, a BlackLotus bootkit, it quietly loads malware *before* Windows starts.

How Was This Discovered?

The vulnerability was privately reported to Microsoft and credited to Jesse Michael and Andrew S. of Eclypsium, who have done prior research on UEFI and Secure Boot flaws.

- Microsoft Advisory
- Eclypsium Analysis

How You Can Protect Yourself

1. Update Now: Apply the latest Windows security updates. The March 2024 updates block known malicious files and improve Secure Boot checks.
2. Revoke Untrusted Bootloaders: Microsoft provides updates to the Secure Boot DBX (forbidden signatures database). This blocks old, vulnerable bootloaders from running even if an attacker installs them.
3. Check Secure Boot State: Ensure Secure Boot is enabled in your UEFI/BIOS firmware settings.

Enable BitLocker: Full disk encryption adds another layer, even if Secure Boot is bypassed.

5. Watch for Firmware Updates: Motherboard and system vendors may release UEFI BIOS updates to help.

Summary

CVE-2024-28923 is a nasty vulnerability that allows attackers to sneak past Secure Boot protections, loading malware before your Windows OS has a chance to defend itself. Physical or admin access is required for this attack, but its impact is severe — rootkits, persistence, and data theft all become much easier.

Patch your system and stay alert for both Windows and firmware updates!

More Information & References

- Official Microsoft Advisory: CVE-2024-28923
- Eclypsium: BlackLotus and Secure Boot Bypass
- Secure Boot in Microsoft Docs
- UEFI Secure Boot – Wikipedia

Timeline

Published on: 04/09/2024 17:15:52 UTC
Last modified on: 04/10/2024 13:24:00 UTC