CVE-2022-34302

TechDeepDive

BelowTheSurfaceEpisode72:FromSamsungTVrootshellstoSecureBootbadges

threatintelctr

NEW: CVE-2022-34302 A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbi... (click for more) https://t.co/jkYWV5dftF

threatintelctr

NEW: CVE-2022-34302 A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbi... (click for more) https://t.co/jkYWV5uivF

manabu2111

BitLockerでトラブルの「KB5012170」、それでもインストールが必要 - 窓の杜 https://t.co/faPZSYhMsJ 、「KB5012170」にはセキュリティ機能をバイパスする脆弱性（CVE-2022-34301、CVE-2022-34302、CVE-2022-34303）に関する修正が含まれている、（続く）

rst_cloud

#threatreport #LowCompleteness Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344 | 18-01-2025 Source: https://t.co/w8sX9ZOTCI Key details below ↓ Threats: Blacklotus, Bootkitty, Victims: Howyar technologies inc., Greenware technologies, Radix technologies ltd., Sanfong inc., Wasay software technology inc., Computer education system inc., Signal computer gmbh Industry: Education Geo: Ukraine CVEs: CVE-2022-34302 \[[Vulners](https://t.co/Zw2ntXLYlC)] - CVSS V3.1: *6.7*, - Vulners: Exploitation: Unknown Soft: - horizondatasys uefi bootloader (<2022-06-01) CVE-2024-7344 \[[Vulners](https://t.co/0ErK1MrvYU)] - CVSS V3.1: *6.5*, - Vulners: Exploitation: Unknown LLM extracted TTPs:` T1542, T1098 IOCs: - File: 2 Software: Linux Algorithms: xor Functions: LoadImage Programming Languages: powershell #threatreport: The main idea of the text is the need to revoke and replace Microsoft Windows Production PCA 2011 and Microsoft Corporation UEFI CA 2011 certificates with newer versions to address vulnerabilities related to the BlackLotus bootkit affecting Windows bootloaders. The vulnerability, identified as CVE-2024-7344, could potentially allow the execution of untrusted code during system boot, posing a risk of deploying malicious UEFI bootkits. The text outlines the timeline of vulnerability disclosure, impact on various recovery software suites, exploitation methods, and recommended mitigation strategies such as applying the latest UEFI revocations from Microsoft. It also suggests using PowerShell commands to check for vulnerability impact on Windows systems and emphasizes the importance of additional security measures, including managing access to EFI system partition files and implementing remote attestation for validation against known good values. Lastly, it addresses concerns about the need for transparency in Microsoft's UEFI third-party code-signing review and highlights the upcoming rollout of new UEFI certificates as an opportunity to enhance UEFI security standards.