Microsoft finally patches serious UEFI Secure Boot flaw after seven-month delay

[ad_1] Backside line: Microsoft has addressed a big safety vulnerability that left Home windows 11 open to malware assaults at one of many system's most crucial ranges for greater than half a 12 months. It is regarding – although maybe not shocking – that Microsoft knowingly left this loophole unpatched for such an extended interval. Customers are strongly suggested to use the replace instantly.

The vulnerability (CVE-2024-7344) allowed unhealthy actors to sneak malicious code onto units in a means that would bypass lots of Home windows 11's built-in safety defenses. It exploited a flaw in how sure third-party firmware utilities dealt with safe UEFI boot processes, giving attackers elevated system privileges and permitting their malicious payloads to cover in plain sight. These varieties of firmware-based assaults are among the many most tough to detect.

The problem stems from how some official system utilities use Microsoft-approved digital certificates. The corporate has a strict guide evaluate course of for third-party firmware apps that should run in the course of the safe boot part. Nevertheless, a researcher at safety agency ESET found that at the very least seven completely different distributors had been utilizing a signed firmware element referred to as "reloader.efi" in an insecure method.

By using a customized executable loader, these utilities might inadvertently bypass Microsoft's safety checks and run any firmware code, together with unsigned binaries that safe boot protections ought to have blocked. That opened the door for classy attackers to piggyback malware onto official utilities.

The distributors who unknowingly uncovered this danger with their system utilities embody Howyar Applied sciences, Greenware, Radix, Sanfong, WASAY, CES, and SignalComputer. They've all issued updates to deal with the problem. Microsoft has additionally revoked the digital certificates for the affected firmware variations, which ought to forestall hackers from exploiting the safety gap.

Nonetheless, the larger story is how the vulnerability continued for over seven months after ESET initially notified Redmond of the issue in July 2024. There is no proof that hackers actively leveraged this vulnerability in real-world assaults. Nevertheless, the truth that such a evident gap existed for such an prolonged interval is disconcerting.

Microsoft has pushed out an replace to resolve CVE-2024-7344, so Home windows 11 customers ought to guarantee they've all the most recent patches put in – particularly from the January 14th Patch Tuesday launch.