initroot

initroot：摩托罗拉引导加载程序内核命令行注入安全启动与设备锁定绕过 CVE-2016-10277 作者：Roee Hay / Aleph Research, HCL Technologies 第一阶段漏洞利用：临时越狱 该漏洞利用可在设备上获得临时的无限制 root 访问权限。 例如，在 cedric 上（部分消息已移除以提高可读性）： $ cd ./tethered/cedric $ ./initroot-tethered.sh Welcome to initroot-cedric-tethered ... bootloader bootloader bootloader a...

CVE-2024-7344

🐞 CVE-2024-7344: Carga Incorrecta de Imágenes PE Este repositorio contiene material de investigación relacionado con CVE-2024-7344, una vulnerabilidad de bypass de Secure Boot que afecta a sistemas UEFI. Centraliza el análisis técnico de la vulnerabilidad, la documentación del flujo de ataque y l...

CVE-2022-21894

baton drop CVE-2022-21894：Secure Boot 安全功能绕过漏洞 Windows 启动应用程序允许使用 truncatememory 设置从内存映射中移除包含序列化数据“持久”范围的内存块，从而导致 Secure Boot 绕过。 truncatememory BCD 元素会从内存映射中移除指定物理地址以上的所有内存。 此操作在每个启动应用程序初始化时执行，此时序列化的 Secure Boot 策略尚未从内存中读取。 因此，可以使用此类元素将序列化的 Secure Boot 策略从内存映射中移除。...

BlackLotus

BlackLotus BlackLotus 是一款专为 Windows 设计的创新 UEFI Bootkit。它内置了安全启动绕过以及 Ring0/内核保护功能，以防止任何删除尝试。该软件用作 HTTP 加载器。凭借其强大的持久性，无需频繁使用新加密方法更新 Agent。一旦部署，传统防病毒软件将无法扫描和清除它。该软件包含两个主要组件：安装在目标设备上的 Agent，以及管理员用于管理僵尸主机的 Web 界面。在此上下文中，僵尸主机指安装了 Agent 的设备。 仅供参考 ：此版本的 BlackLotus v2 已移除 baton drop，并用 bootlicker 替换了原始版本的...

CVE-2025-47827

CVE-2025-47827 针对 CVE-2025-47827 的概念验证与漏洞报告。 目录 描述 披露 影响 检测 缓解措施 二进制文件 概念验证 资源 描述 在 v11 之前的 IGEL OS 中，Secure Boot 可被绕过，原因是 igel-flash-driver 模块未正确验证密码学签名。最终，一个精心构造的根文件系统可以从未经验证的 SquashFS 镜像中挂载。 IGEL OS 10 中 Linux 内核模块 igel-flash-driver 对密码学签名验证不当，允许恶意行为者通过启动由 Microsoft 第三方 UEFI CA 签名的 shim 来绕过...

CVE-2026-25250

🕷️ CVE-2026-25250: Validación Incorrecta de la Cadena de Carga de Arranque Confiable Un cargador de arranque de terceros firmado por Microsoft que carga un binario EFI secundario sin verificación de firma ni integridad, colapsando la cadena de confianza de Secure Boot desde dentro. 📑 Tabla de...

CVE-2022-34303

🕷️ CVE-2022-34303 - Vulnerabilidad del Boot Loader de CryptoPro CryptoPro Secure Disk UEFI Shell - Bring Your Own Vulnerable UEFI Application BYOVUA - Omisión de Secure Boot mediante un UEFI Shell firmado y corrupción de gSecurity2. 📑 Tabla de Contenidos Descripción General Antecedentes Bring Your...

CVE-2022-34302

🕷️ CVE-2022-34302 - Nueva vulnerabilidad del cargador de arranque de New Horizon Datasys New Horizon Datasys Reboot Restore Boot Loader - Bring Your Own Vulnerable UEFI Application BYOVUA - Omisión de Secure Boot mediante un cargador de arranque firmado con un cargador PE/COFF personalizado...

CVE-2025-0690

CVE-2025-0690: Vulnerabilidad de Desbordamiento de Enteros en GRUB2 🛡️ Descripción General CVE-2025-0690 es una vulnerabilidad crítica de desbordamiento de enteros en el cargador de arranque GRUB2 , que permite la ejecución de código arbitrario y la evasión de Secure Boot. Esta falla afecta a...

Vendor-signed UEFI Shell applications allow Secure Boot bypass

Overview Vendor-signed UEFI Shell applications may allow an attacker to bypass Secure Boot protections by abusing commands such as mm Memory Modify. On systems that trust the affected vendor’s certificate or include the application’s Authenticode hash in the UEFI Authorized Signature Database DB,...

Cisco UCS Manager UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials fo...

Cisco Integrated Management Controller UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, the Cisco Integrated Management Controller is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with vali...

Astra Linux – Vulnerability in edk2

In Ubuntu’s EDK2, a insecure default setting was left enabled, allowing UEFI Shell to be used. This enables an attacker with access to the operating system to bypass Secure Boot...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module that serves as a dependency without checking whether any other dependent modules are still loaded, leading to a “use-after-free” scenario. This could allow arbitrary code to be...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. When reading the name of a symbolic link from a UFS filesystem, grub2 fails to validate the string length provided as input. This lack of validation may lead to a heap out-of-bounds write, causing data integrity issues and potentially allowing an attacker to...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read without sufficient bounds checking, assuming that the USB device provides valid values. If exploited properly, an attacker could cause memory corruption, leading to arbitrary code...

Astra Linux – Vulnerability in grub2

A crafted 16-bit grayscale PNG image may lead to an out-of-bounds write in the heap area. An attacker may exploit this to cause heap data corruption or, ultimately, arbitrary code execution and circumvent secure boot protections. This issue is highly complex to exploit; an attacker needs to perfo...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking, allowing a privileged attacker to remove address ranges from memory. This creates an opportunity to circumvent SecureBoot protections after proper analysis of grub’s memory layout. The...

Astra Linux – Vulnerability in edk2

The Ubuntu edk2 UEFI firmware packages accidentally allowed access to the UEFI Shell in Secure Boot environments, potentially enabling bypass of Secure Boot restrictions. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some earlier versions introduced a security measure base...

Astra Linux – Vulnerability in grub2

A carefully crafted JPEG image may cause the JPEG reader to underflow its data pointer, allowing user-controlled data to be written into the heap. For the attack to succeed, the attacker must analyze the heap layout and create an image with malicious format and payloads. This vulnerability can le...