CVE-2026-25250

🕷️ CVE-2026-25250: 信頼されたブートローダーチェーン検証の不備 署名または整合性検証なしでセカンダリEFIバイナリを読み込む、Microsoft署名のサードパーティ製ブートローダー。内部からSecure Bootの信頼チェーンを崩壊させます。 📑 目次 研究背景 公式リファレンス 自分で再現する 脆弱なブートチェーン 脆弱性の概要 📂 Secure Bootと信頼モデル 根本原因分析 悪用プロセス 緩和策と失効 🧠 研究背景...

shim: 3rd party shim allow secure boot bypass

A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use...

SUSE CVE-2022-34301

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader...

CVE-2022-34302

A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader...

Input validation

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader...

PT-2022-4307 · Microsoft +3 · Windows +3

Name of the Vulnerable Software and Affected Versions: Eurosoft bootloaders versions prior to 2022-06-01 Description: A flaw was found in Eurosoft bootloaders that allows an attacker to bypass or tamper with Secure Boot protections. To load and execute arbitrary code in the pre-boot stage, an...