Zammis Clark

تتعلق المشكلة بثغرة أمنية تسمح بالتحايل على ميزة الأمان في مكون «Secure Boot» (التشغيل الآمن) بنظام التشغيل Windows. وترتبط هذه الثغرة بخلل في آلية حماية البيانات. قد يؤدي استغلال هذه المشكلة إلى تمكين المهاجم من التحايل على قيود الأمان. لا توجد معلومات متوفرة حول العدد التقديري للأجهزة التي قد تكون متأثرة أو حول حوادث فعلية تم فيها استغلال هذه المشكلة.

تتعلق المشكلة بأخطاء في التحكم في الوصول عند تطبيق بروتوكول Secure Boot في نظام التشغيل Windows. وقد يتيح ذلك للمهاجم الكشف عن معلومات محمية. لم يتم تقديم أي معلومات حول العدد التقديري للأجهزة التي قد تكون متأثرة في جميع أنحاء العالم، ولا تفاصيل حول حوادث فعلية تم فيها استغلال هذه المشكلة.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The issue is related to a buffer overflow in dynamic memory in the implementation of the Secure Boot protocol in Windows operating systems. This can be exploited by sending specially crafted data, allowing an attacker to bypass existing security restrictions. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a buffer overflow in memory during the implementation of the Secure Boot protocol in Windows operating systems. This could allow an attacker to bypass security restrictions. A security-feature bypass vulnerability allows attackers to affect the system.

The issue is related to a security feature bypass vulnerability in the implementation of the Secure Boot protocol in Windows operating systems. This vulnerability is associated with inadequate access control restrictions. Exploitation of this issue may allow an attacker to bypass security restrictions.

The issue is related to a security feature bypass in the implementation of the Secure Boot protocol in Windows operating systems, which is associated with a data protection mechanism violation. This could allow an attacker to bypass security restrictions.

The issue is related to a security-feature bypass vulnerability in the implementation of the Secure Boot protocol in Windows operating systems. This vulnerability is associated with a data protection mechanism breach. Exploitation of this issue may allow an attacker to bypass existing security restrictions.

The issue is related to a security-feature bypass vulnerability in the implementation of the Secure Boot protocol in Windows operating systems. This vulnerability is associated with a violation of the data protection mechanism. Exploitation of the vulnerability may allow an attacker to bypass existing security restrictions.

The issue is related to a security feature bypass vulnerability in the implementation of the Secure Boot protocol in Windows operating systems. This vulnerability is associated with a violation of the data protection mechanism. Exploitation of the issue may allow an attacker to bypass existing security restrictions.

The issue is related to a security feature bypass vulnerability in the BitLocker data protection function of the Microsoft Windows operating system. This vulnerability is associated with a disruption in the data protection mechanism. Exploitation of this issue may allow an attacker to bypass existing security restrictions.

The issue is related to a buffer overflow in the Secure Boot protocol implementation, which can be exploited to bypass security restrictions. This could allow an attacker to affect the system. No information is provided about the estimated number of potentially affected devices or real-world incidents.

A security feature bypass in the BitLocker data protection function allows an attacker with physical access to an unpatched PC to bypass existing security restrictions and encryption.

A security-feature bypass issue exists in the Windows Secure Boot implementation due to errors in accessing debugging functions during the boot process. This flaw allows an attacker to bypass existing security restrictions. Specifically, the issue can be exploited by triggering a boot error to read the BitLocker decryption key from memory, as the bootloader fails to clear it. Furthermore, attackers can downgrade the bootloader to a vulnerable version to exploit this memory reading flaw, even on fully updated Windows 11 systems with Secure Boot enabled. This vulnerability has been linked to the deployment of UEFI bootkits by the FishMonger threat group to ensure persistence and stealth on targeted government systems.

The issue is related to errors in security settings of the Windows Boot Manager, allowing an attacker to bypass security restrictions. This can potentially affect the system.

The issue is related to errors in security settings of the Windows Boot Manager, allowing an attacker to bypass security restrictions. This can potentially affect the system.

The issue is related to a security feature bypass in the Windows Boot Manager of Microsoft Windows operating systems. This could allow an attacker to bypass the BitLocker device encryption feature and access encrypted data.

A security-feature bypass issue exists in the Windows BitLocker component caused by a race condition, which occurs when multiple processes attempt to access the same resource simultaneously. This flaw allows an attacker with brief physical access and network connectivity to bypass encryption and gain unauthorized access to protected information.

The issue is related to errors in security settings, allowing an attacker to bypass the authentication process. It is a security-feature bypass vulnerability that enables attackers to affect the system. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to a security feature bypass in the Windows Boot Manager, which is associated with insufficient access control. This could allow an attacker to bypass existing security restrictions. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

A security feature bypass allows attackers to circumvent Secure Boot, enabling the installation of UEFI bootkits such as BlackLotus. This issue is exploited by deploying vulnerable signed binary files into the EFI system partition, which allows the attacker to register a malicious Machine Owner Key (MOK) in the `MokList` and NVRAM variables. Once established, the attacker can use legitimate Microsoft-signed firmware to launch a self-signed bootkit. This level of persistence allows the malware to control the operating system boot process and disable security mechanisms including Hypervisor-Protected Code Integrity (HVCI) and BitLocker. The bootkit may also deploy an HTTP loader to communicate with command-and-control servers for executing commands and loading additional payloads. Technical artifacts are often dropped in the `EFIMicrosoftBootsystem32` path.