android-hardware-attestation-demo

Bypass de atestación de hardware de Android — demo Este repositorio acompaña a un artículo de Quarkslab sobre la atestación de claves Key Attestation de hardware de Android y existe para ilustrarlo. Es una prueba de concepto pequeña y de extremo a extremo que muestra un bypass simple: un analista...

CVE-2022-21894

baton drop CVE-2022-21894：Secure Boot 安全功能绕过漏洞 Windows 启动应用程序允许使用 truncatememory 设置从内存映射中移除包含序列化数据“持久”范围的内存块，从而导致 Secure Boot 绕过。 truncatememory BCD 元素会从内存映射中移除指定物理地址以上的所有内存。 此操作在每个启动应用程序初始化时执行，此时序列化的 Secure Boot 策略尚未从内存中读取。 因此，可以使用此类元素将序列化的 Secure Boot 策略从内存映射中移除。...

edk2

============== EDK II Project A modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications from www.uefi.org. .. image::...

initroot

initroot：摩托罗拉引导加载程序内核命令行注入安全启动与设备锁定绕过 CVE-2016-10277 作者：Roee Hay / Aleph Research, HCL Technologies 第一阶段漏洞利用：临时越狱 该漏洞利用可在设备上获得临时的无限制 root 访问权限。 例如，在 cedric 上（部分消息已移除以提高可读性）： $ cd ./tethered/cedric $ ./initroot-tethered.sh Welcome to initroot-cedric-tethered ... bootloader bootloader bootloader a...

CVE-2022-34303

🕷️ CVE-2022-34303 - Vulnerabilidad del Boot Loader de CryptoPro CryptoPro Secure Disk UEFI Shell - Bring Your Own Vulnerable UEFI Application BYOVUA - Omisión de Secure Boot mediante un UEFI Shell firmado y corrupción de gSecurity2. 📑 Tabla de Contenidos Descripción General Antecedentes Bring Your...

CVE-2022-34301

🕷️ CVE-2022-34301 - Vulnerabilidad del Boot Loader de Eurosoft Eurosoft Pc-Check UEFI Diagnostics Shell - Bring Your Own Vulnerable UEFI Application BYOVUA - Omisión de Secure Boot mediante un UEFI Shell firmado y corrupción de gSecurity2. 📑 Tabla de Contenidos Descripción General Antecedentes...

CVE-2022-34302

🕷️ CVE-2022-34302 - Nueva vulnerabilidad del cargador de arranque de New Horizon Datasys New Horizon Datasys Reboot Restore Boot Loader - Bring Your Own Vulnerable UEFI Application BYOVUA - Omisión de Secure Boot mediante un cargador de arranque firmado con un cargador PE/COFF personalizado...

CVE-2025-0690

CVE-2025-0690: GRUB2 整数溢出漏洞 🛡️ 概述 CVE-2025-0690 是引导加载程序 GRUB2 中的一个 整数溢出 关键漏洞，允许 任意代码执行 和 绕过 Secure Boot 。该缺陷影响依赖 GRUB2 进行安全启动的系统，在操作系统启动前暴露系统。 🔍 技术细节 根本原因 易受攻击的命令 ：read（用于接收键盘输入）。 问题 ：输入长度存储在一个 32 位整数 中。 利用机制 ： 输入极长的文本行。 导致长度变量 溢出 。 进而导致基于 堆 的缓冲区发生 越界写入（out-of-bounds write） 。 后果 破坏 GRUB2 内部关键数据 。...

Rocky Linux 9 [CIQ] Security Update: grub2-common / grub2-efi-aa64 / grub2-efi-aa64-cdboot / etc Multiple Vulnerabilities (crlsa-2023_0752)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230752 advisory. grub2: Buffer overflow in grubfontconstructglyph can lead to out-of-bound write and possible secure boot bypass CVE-2022-2601 grub2: Heap based out-of-boun...

CentOS Linux 8 [TuxCare] Security Update: grub2-efi-ia32-cdboot / grub2-efi-ia32-modules / grub2-efi-x64 / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2025:1744213211)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2025:1744213211 advisory. - A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of...

AlmaLinux 9.2 [TuxCare] Security Update: grub2-common / grub2-efi-aa64-modules / grub2-efi-x64 / etc (ALMALINUX9.2:CLSA-2024:1707226462)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1707226462 advisory. - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NT...

AlmaLinux 9.2 [TuxCare] Security Update: grub2-common / grub2-efi-aa64-modules / grub2-efi-x64 / etc (ALMALINUX9.2:CLSA-2026:1779370563)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779370563 advisory. - A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal...

CVE-2024-7344

🐞 CVE-2024-7344: Carga Incorrecta de Imágenes PE Este repositorio contiene material de investigación relacionado con CVE-2024-7344, una vulnerabilidad de bypass de Secure Boot que afecta a sistemas UEFI. Centraliza el análisis técnico de la vulnerabilidad, la documentación del flujo de ataque y l...

CVE-2025-47827

CVE-2025-47827 针对 CVE-2025-47827 的概念验证与漏洞报告。 目录 描述 披露 影响 检测 缓解措施 二进制文件 概念验证 资源 描述 在 v11 之前的 IGEL OS 中，Secure Boot 可被绕过，原因是 igel-flash-driver 模块未正确验证密码学签名。最终，一个精心构造的根文件系统可以从未经验证的 SquashFS 镜像中挂载。 IGEL OS 10 中 Linux 内核模块 igel-flash-driver 对密码学签名验证不当，允许恶意行为者通过启动由 Microsoft 第三方 UEFI CA 签名的 shim 来绕过...

CVE-2026-25250

🕷️ CVE-2026-25250: Validación Incorrecta de la Cadena de Carga de Arranque Confiable Un cargador de arranque de terceros firmado por Microsoft que carga un binario EFI secundario sin verificación de firma ni integridad, colapsando la cadena de confianza de Secure Boot desde dentro. 📑 Tabla de...

Vendor-signed UEFI Shell applications allow Secure Boot bypass

Overview Vendor-signed UEFI Shell applications may allow an attacker to bypass Secure Boot protections by abusing commands such as mm Memory Modify. On systems that trust the affected vendor’s certificate or include the application’s Authenticode hash in the UEFI Authorized Signature Database DB,...

Cisco UCS Manager UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials fo...

Cisco Integrated Management Controller UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, the Cisco Integrated Management Controller is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with vali...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. A specially crafted JPEG file can cause the JPEG parser in grub2 to incorrectly check the boundaries of its internal buffers, leading to an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is still a concer...

Astra Linux – Vulnerability in u-boot

The U-Boot until 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration...