“Code executed in this early boot phase can persist on the system, potentially loading malicious kernel extensions that survive both reboots and OS reinstallation,” the CERT Coordination Center (CERT/CC) said. “Additionally, it may evade detection by OS-based and endpoint detection and response (EDR) security measures.”
Malicious actors could further expand the scope of exploitation by bringing their own copy of the vulnerable “reloader.efi” binary to any UEFI system with the Microsoft third-party UEFI certificate enrolled. However, elevated privileges are required to deploy the vulnerable and malicious files to the EFI system partition: local administrator on Windows and root on Linux.
The Slovakian cybersecurity firm said it responsibly disclosed the findings to the CERT/CC in June 2024, following which Howyar Technologies and their partners addressed the issue in the concerned products. On January 14, 2025, Microsoft revoked the old, vulnerable binaries as part of its Patch Tuesday update.
Leave a reply