CVE-2021-3972

CVE-2021-3972 仅包含 PoC 代码，无其他内容 BYTE value = 0x1; SetFirmwareEnvironmentVariableExT"ChgBootSecureBootDisable",T"6ACCE65D-DA35-4B39-B64B-5ED927A7DC7E",&value,sizeofBYTE,0x7; SetFirmwareEnvironmentVariableExT"ChgBootChangeLegacy",T"6ACCE65D-DA35-4B39-B64B-5ED927A7DC7E",&value,sizeofBYTE,0x7;...

secure-boot-cert-servicing

Secure Boot Certificate Rollover — assessment and servicing A single, self-contained PowerShell script that assesses a Windows machine's Secure Boot certificate posture for the 2011 → 2023 rollover CVE-2023-24932 / KB5025885 and, only when you explicitly ask it to, opts that machine in to the...

CVE-2026-8863

CVE-2026-8863 Collection of the signed UEFI Secure Boot shim binaries affected by CVE-2026-8863, with the embedded shim version, Authenticode signer and revocation hashes of each image. Releases that ship the byte-identical signed shim are collapsed onto a single row — one Authenticode hash is on...

Orchestrated-Powershell-for-CVE-2023-24932-en

Secure Boot Mitigation Orchestrator Script Overview This PowerShell script automates the Secure Boot mitigation steps for CVE-2023-24932 , as outlined in the Microsoft Security Guidance. It handles the entire process, including registry updates, reboots, and event log validation, to ensure your...

CVE-2025-0690

CVE-2025-0690: Integer Overflow Vulnerability in GRUB2 🛡️ Overview CVE-2025-0690 is a critical integer overflow vulnerability in the GRUB2 boot loader, allowing arbitrary code execution and Secure Boot bypass. This flaw affects systems that rely on GRUB2 for secure boot, exposing the system before...

Orchestrated-Powershell-for-CVE-2023-24932

Secure Boot Orchestrator CVE-2023-24932 Automates the full Secure Boot mitigation for CVE-2023-24932 BlackLotus. Handles all registry changes, reboots, and verification automatically. Requirements Windows 10/11 or Server 2016+ Administrator privileges Secure Boot enabled Cumulative Update = July...

Rocky Linux 9 [CIQ] Security Update: grub2-common / grub2-efi-aa64 / grub2-efi-aa64-cdboot / etc Multiple Vulnerabilities (crlsa-2023_0752)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230752 advisory. grub2: Buffer overflow in grubfontconstructglyph can lead to out-of-bound write and possible secure boot bypass CVE-2022-2601 grub2: Heap based out-of-boun...

CentOS Linux 8 [TuxCare] Security Update: grub2-efi-ia32-cdboot / grub2-efi-ia32-modules / grub2-efi-x64 / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2025:1744213211)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2025:1744213211 advisory. - A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of...

AlmaLinux 9.2 [TuxCare] Security Update: grub2-common / grub2-efi-aa64-modules / grub2-efi-x64 / etc (ALMALINUX9.2:CLSA-2024:1707226462)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1707226462 advisory. - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NT...

AlmaLinux 9.2 [TuxCare] Security Update: grub2-common / grub2-efi-aa64-modules / grub2-efi-x64 / etc (ALMALINUX9.2:CLSA-2026:1779370563)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779370563 advisory. - A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal...

CVE-2024-7344

🐞 CVE-2024-7344: 不適切なPEイメージ読み込み このリポジトリには、UEFIシステムに影響を与えるSecure Boot回避の脆弱性であるCVE-2024-7344に関連する研究資料が含まれています。この脆弱性の技術的分析、攻撃フローのドキュメント、および管理された環境で脆弱な動作を再現するために作成された再現アプリケーションを一元管理しています。また、セキュリティ研究者がこの脆弱性に関連する技術を理解、研究、実験するのに役立つドキュメントと研究リソースも含まれています。 📑 目次 最初の発見と公式リファレンス 脆弱なバイナリ（実世界／教育用） 脆弱性の概要（分析と悪用）...

CVE-2025-47827

CVE-2025-47827 Proof-of-concept and vulnerability report for CVE-2025-47827. Contents Description Disclosure Impact Detection Mitigation Binaries Proof of Concept Resources Description In IGEL OS before v11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a...

CVE-2026-25250

🕷️ CVE-2026-25250: 信頼されたブートローダーチェーン検証の不備 署名または整合性検証なしでセカンダリEFIバイナリを読み込む、Microsoft署名のサードパーティ製ブートローダー。内部からSecure Bootの信頼チェーンを崩壊させます。 📑 目次 研究背景 公式リファレンス 自分で再現する 脆弱なブートチェーン 脆弱性の概要 📂 Secure Bootと信頼モデル 根本原因分析 悪用プロセス 緩和策と失効 🧠 研究背景...

virt-firmware

Tools for ovmf / armvirt firmware volumes This is a small collection of tools for edk2 firmware images. They support decoding and printing the content of firmware volumes. Variable stores OVMFVARS.fd can be modified, for example to enroll secure boot certificates. virt-fw-dump Decodes and prints...

BootHoleFix

Boot Hole Fix This script will remediate the BootHole bug identified in CVE-2020-25632 and/or CVE-2021-20233. On July 29, 2020, Microsoft published security advisory 200011 that describes a new vulnerability that's related to Secure Boot. Devices that trust the Microsoft third-party Unified...

CVE-2022-34301

🕷️ CVE-2022-34301 - Eurosoft 引导加载程序漏洞 Eurosoft Pc-Check UEFI 诊断 Shell - 自带易受攻击的 UEFI 应用程序 BYOVUA - 通过已签名的 UEFI Shell 和 gSecurity2 破坏实现 Secure Boot 绕过。 📑 目录 概述 背景 自带易受攻击的 UEFI 应用程序 已签名的 Shell 漏洞 mm 命令 gSecurity2 与安全架构协议 与内核 BYOVD 的相似之处 工作原理 阶段 1 - 启动已签名的 Shell 阶段 2 - 枚举 Security2 协议句柄 阶段 3 - 在内存中定位...

CVE-2022-34303

🕷️ CVE-2022-34303 - CryptoPro 引导加载程序漏洞 CryptoPro Secure Disk UEFI Shell - 自带易受攻击的 UEFI 应用程序 BYOVUA - 通过签名的 UEFI Shell 和 gSecurity2 破坏实现 Secure Boot 绕过。 📑 目录 概述 背景 自带易受攻击的 UEFI 应用程序 已签名的 Shell 漏洞 mm 命令 gSecurity2 与安全架构协议 与内核 BYOVD 的相似之处 工作原理 阶段 1 - 启动已签名的 Shell 阶段 2 - 枚举 Security2 协议句柄 阶段 3 - 在内存中定...

rp2350_hacking_challenge

RP2350 黑客挑战赛 欢迎参加 Raspberry Pi RP2350 黑客挑战赛和漏洞赏金计划！ 观看我们的快速讲解视频： 2025年1月14日更新 恭喜4位获奖者！在这里了解他们的全部信息。 衷心感谢 Thomas Roth 和 Hextree.io 团队在2024年帮助我们开发和启动这项挑战！ 2025年1月1日更新 RP2350 黑客挑战赛已结束。 我们收到了许多精彩的提交！我们将在2025年1月14日公布获奖者并发布详细信息。 2024年9月5日更新 目前尚未收到任何破解报告。 我们将奖金翻倍至 $20,000！...

Vendor-signed UEFI Shell applications allow Secure Boot bypass

Overview Vendor-signed UEFI Shell applications may allow an attacker to bypass Secure Boot protections by abusing commands such as mm Memory Modify. On systems that trust the affected vendor’s certificate or include the application’s Authenticode hash in the UEFI Authorized Signature Database DB,...

Cisco UCS Manager UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials fo...