Howyar Reloader UEFI Application: UEFI Secure Boot bypass (CVE-2024-7344) #shorts

Summary

Today on our podcast, we delve into a critical new vulnerability identified as CVE-2024-7344. This vulnerability pertains to a UEFI Secure Boot bypass in several software applications, including those from Howyar Technologies. The vulnerability allows attackers to deploy malicious bootkits by bypassing Secure Boot protections, raising significant concerns for device security and integrity.

Product details

CVE-2024-7344 affects multiple products across different technology providers. The affected products include Radix SmartRecovery, Greenware Technologies GreenGuard, Howyar Technologies SysReturn, SANFONG EZ-Back System, CES Taiwan's CES NeoImpact, and SignalComputer's HDD King. The vulnerability impacts all versions less than specific builds, necessitating urgent updates to secure these systems.

Vulnerability type summary

The vulnerability is categorized under CWE-426: Untrusted Search Path and CWE-347: Lack or Improper Verification of Cryptographic Signature. These categorizations indicate issues with software execution in secure environments without adequate verification, thereby allowing potentially harmful unsigned software to be executed.

Details of the vulnerability

The vulnerability discovered by researchers at ESET relates to the Howyar UEFI Application 'Reloader'. It involves execution of unsigned software in a hardcoded path, which bypasses Secure Boot protections and could potentially lead to privilege escalation. The critical nature of this vulnerability stems from its capability to undermine Secure Boot, a core security feature intended to prevent unauthorized boot code from running on a device.

Conclusion

In conclusion, CVE-2024-7344 represents a significant security risk as it compromises the Secure Boot process, allowing potential bootkit deployment. It is crucial for affected users to apply the recommended patches immediately to mitigate possible exploitation. As of now, no active exploit has been reported, but the potential implications underline the importance of maintaining up-to-date security measures.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://uefi.org/revocationlistfile
• https://uefi.org/specs/UEFI/2.10/32_Secure_Boot_and_Driver_Signing.html
• https://uefi.org/specs/UEFI/2.10/03_Boot_Manager.html
• https://www.eset.com/blog/enterprise/preparing-for-uefi-bootkits-eset-discovery-shows-the-importance-of-cyber-intelligence/