CVE-2024-7344 impacts UEFI based systems

CVE-2024-7344 is a critical vulnerability affecting UEFI-based systems. It was discovered by researchers at ESET and involves a bypass of the UEFI Secure Boot mechanism, allowing untrusted code to run during system boot, posing a significant security risk.

Key Highlights:

1. Source of Vulnerability: The vulnerability was found in a UEFI application signed by Microsoft’s third-party UEFI certificate.
2. Impact: This flaw enables attackers to deploy malicious bootkits, such as Bootkitty and BlackLotus, on systems with UEFI Secure Boot enabled.
3. Affected Software: The issue affects several real-time system recovery software suites from developers like Howyar Technologies Inc., Greenware Technologies, and Radix Technologies Ltd.

Technical Details:

• Custom PE Loader Vulnerability: The root cause is the use of a custom PE (Portable Executable) loader instead of the standard UEFI functions LoadImage and StartImage. This custom loader allows any UEFI binary, including unsigned ones, to load from a specially crafted file named cloak.dat during system boot. This bypasses the UEFI Secure Boot verification process, enabling malicious code execution.
• Security Measures Bypassed: UEFI Secure Boot is designed to ensure that only trusted software is loaded during the boot process. By using a custom PE loader, attackers can execute untrusted and potentially harmful binaries without raising alarms.

Resolution:

• Vendor Patches: The affected vendors have issued patches to address this vulnerability. The resolution involves replacing the custom PE loader with the proper UEFI functions to enforce Secure Boot policies accurately.
• Microsoft’s Response: Microsoft has revoked the vulnerable binaries in the January 14, 2025 Patch Tuesday update, ensuring that systems using affected software no longer run untrusted code during boot.

Implications:

• Risk of Bootkit Deployment: The vulnerability significantly increases the risk of undetectable bootkit deployments. Bootkits can control the entire boot process, making them particularly dangerous as they can evade most security measures.
• Importance of Secure Boot: This vulnerability underscores the critical role of Secure Boot in protecting systems and the need for stringent adherence to Secure Boot policies.

Future Considerations:

• Regular Audits: Organizations should conduct regular security audits of their UEFI implementations to ensure compliance with Secure Boot policies.
• Security Updates: It is essential to stay updated with security patches and advisories from software vendors and hardware providers.
• Security Training: Continual training for IT staff on identifying and mitigating security vulnerabilities can prevent similar issues in the future.

Conclusion:

The discovery of CVE-2024-7344 highlights the need for ongoing vigilance and robust security practices to protect systems against sophisticated attacks. Adhering strictly to Secure Boot protocols and promptly applying security updates can mitigate such risks.