CVE-2025-3052

🐞 CVE-2025-3052: Corrupción de Memoria en IhisiParamBuffer Este repositorio centraliza material de investigación relacionado con CVE-2025-3052, una vulnerabilidad de corrupción de memoria en un módulo UEFI firmado con el certificado de terceros de Microsoft que permite a un atacante corromper...

CVE-2025-4275

🐞 CVE-2025-4275: Hydroph0bia SecureFlash Certificate Shadowing Este repositorio contiene material de investigación relacionado con CVE-2025-4275, una vulnerabilidad de omisión de Secure Boot que afecta al firmware compatible con UEFI basado en Insyde H2O. Centraliza el análisis técnico de la...

test_avb_key

On Almost Signing Android Builds Introduction An error sometimes encountered by NCC Group consultants is signing Android builds with known private keys. This leaves the device manufacturers and in turn their users vulnerable, even on devices where secure boot is enabled. This blog post has two...

CVE-2026-79298

🐞 CVE-2026-79298: Remediación Incompleta del Bypass de UEFI Secure Boot en Howyar SysReturn Se parcheó una vulnerabilidad. Se revocó un binario. Pero solo se corrigió la mitad de la arquitectura. Dieciocho meses después, la ruta de arranque IA-32 seguía llevando el mismo cargador PE personalizado...

CVE-2021-3972

CVE-2021-3972 código de prueba sin nada más BYTE value = 0x1; SetFirmwareEnvironmentVariableExT"ChgBootSecureBootDisable",T"6ACCE65D-DA35-4B39-B64B-5ED927A7DC7E",&value,sizeofBYTE,0x7;...

secure-boot-cert-servicing

Renovación de certificados de Secure Boot — evaluación y servicio Un único script de PowerShell autocontenido que evalúa la postura de certificados de Secure Boot de una máquina Windows para la renovación de 2011 → 2023 CVE-2023-24932 / KB5025885 y, solo cuando se lo pides explícitamente, inscrib...

CVE-2026-8863

CVE-2026-8863 Collection of the signed UEFI Secure Boot shim binaries affected by CVE-2026-8863, with the embedded shim version, Authenticode signer and revocation hashes of each image. Releases that ship the byte-identical signed shim are collapsed onto a single row — one Authenticode hash is on...

Orchestrated-Powershell-for-CVE-2023-24932-en

Script orquestador de mitigación de Secure Boot Descripción general Este script de PowerShell automatiza los pasos de mitigación de Secure Boot para CVE-2023-24932 , tal como se describe en la Guía de seguridad de Microsoft. Gestiona todo el proceso, incluidas las actualizaciones del registro, lo...

CVE-2025-0690

CVE-2025-0690: Vulnerabilidad de Desbordamiento de Enteros en GRUB2 🛡️ Descripción General CVE-2025-0690 es una vulnerabilidad crítica de desbordamiento de enteros en el cargador de arranque GRUB2 , que permite la ejecución de código arbitrario y la evasión de Secure Boot. Esta falla afecta a...

Orchestrated-Powershell-for-CVE-2023-24932

Orquestador de Secure Boot CVE-2023-24932 Automatiza toda la mitigación de Secure Boot para CVE-2023-24932 BlackLotus. Gestiona todos los cambios de registro, reinicios y verificación automáticamente. Requisitos Windows 10/11 o Server 2016+ Privilegios de administrador Secure Boot habilitado...

Vendor-signed UEFI Shell applications allow Secure Boot bypass

Overview Vendor-signed UEFI Shell applications may allow an attacker to bypass Secure Boot protections by abusing commands such as mm Memory Modify. On systems that trust the affected vendor’s certificate or include the application’s Authenticode hash in the UEFI Authorized Signature Database DB,...

Cisco UCS Manager UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials fo...

Cisco Integrated Management Controller UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, the Cisco Integrated Management Controller is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with vali...

Astra Linux – Vulnerability in edk2

In Ubuntu’s EDK2, a insecure default setting was left enabled, allowing UEFI Shell to be used. This enables an attacker with access to the operating system to bypass Secure Boot...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. When reading the name of a symbolic link from a UFS filesystem, grub2 fails to validate the string length provided as input. This lack of validation may lead to a heap out-of-bounds write, causing data integrity issues and potentially allowing an attacker to...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module that serves as a dependency without checking whether any other dependent modules are still loaded, leading to a “use-after-free” scenario. This could allow arbitrary code to be...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: restricted usage in unprivileged domU The Xen privcmd driver allows for the issuance of arbitrary hypercalls from user space processes. This is normally not a problem, as access is usually limited to root, and the...

Astra Linux – Vulnerability in grub2

The GRUB2’s shimlock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules being loaded in GRUB2, thereby breaking the secure boot trust-chain...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, if the IMA appraisal method is used with the “imaappraiselog” boot parameter, lockdown can be circumvented using kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents the “imaappraiselog” parameter from being set during boot, but this does not cover...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation against possible integer overflows. It’s possible to cause the allocation length to overflow with a specially crafted tar file, resulti...