Earlier this week, Microsoft released a patch to fix the Secure Boot bypass bug used by the BlackLotus bootkit that we reported back in March. The original vulnerability CVE-2022-21894was patched in January, but the new patch for CVE-2023-24932 addresses another actively used workaround for systems running Windows 10 and 11 and versions of Windows Server starting with Windows Server 2008.
The BlackLotus bootkit is the first real-world malware known to be able to bypass Secure Boot protections, allowing malicious code to execute before your computer starts loading Windows and its many protections. For more than a decade, Secure Boot has been enabled by default on most Windows PCs sold by companies such as Dell, Lenovo, HP, Acer, and others. On computers running Windows 11, it must be enabled to meet the software’s system requirements.
Microsoft says the vulnerability could be exploited by an attacker with either physical access to the system or administrative rights on the system, which could affect physical PCs and virtual machines with Secure Boot enabled.
We’re highlighting the new fix in part because, unlike many high-priority Windows fixes, this update will be disabled by default for at least a few months after you install it, and in part because it will eventually make your current Windows bootable media inaccessible to downloads. The fix requires changes to the Windows Boot Manager that cannot be undone once enabled.
“The secure boot feature precisely controls the bootable media that is allowed to boot at operating system startup, and if this fix is not properly enabled, it can cause a crash and prevent the system from starting,” one of them says. from several Microsoft support articles about the update.
In addition, once the patches are enabled, your computer will no longer be able to boot from old bootable media that does not contain the patches. On long list of affected media: Windows installation media such as DVDs and USB sticks created from Microsoft ISO files; custom Windows installation images maintained by IT departments; full system backups; network boot drives, including those used by IT departments to troubleshoot machines and deploy new Windows images; stripped-down boot disks that use Windows PE; and recovery media sold with OEM PCs.
Not wanting to suddenly make user systems unbootable, Microsoft will release the update in stages over the next few months. The original version of the patch requires significant user intervention to enable– You first need to install the May Security Updates and then use a five-step process to manually apply and verify a couple of “recall files” that update your system’s hidden EFI boot partition and your registry. This will make it so that PCs will no longer trust older, vulnerable versions of the bootloader.
A second update will follow in July, which will not include the default fix, but will make it Take it easy turn on. The third update in “Q1 2024” will enable the fix by default and make older bootable media unbootable on all PCs with Windows patches installed. Microsoft says it is “looking into opportunities to speed up this timeline,” though it’s not clear what that would entail.
Jean-Ian Boutin, Director of Threat Research at ESET, described the severity of BlackLotus and other Ars bootkits when we originally reported it:
The final conclusion is that the BlackLotus UEFI bootkit can be installed on modern systems running the latest version of Windows with secure boot enabled. Although the vulnerability is deprecated, it can still be used to bypass all security measures and compromise the system boot process, which gives an attacker control over the early phase of system startup. It also illustrates a trend where attackers are focusing on the EFI System Partition (ESP) rather than the firmware for their implants, sacrificing stealth to ease deployment but providing a similar level of capability.
This patch is not the only recent security incident that highlights the difficulty of patching low-level Secure Boot and UEFI vulnerabilities; Computer and motherboard maker MSI recently had its signing keys leaked in a ransomware attack, and there is no easy way for the company to prevent its products from trusting firmware updates signed with a compromised key.