Secure Boot Security Feature Bypass Vulnerability Recently updated
Released: May 9, 2023
Last updated: Feb 11, 2025
- Assigning CNA
- Microsoft
- CVE.org link
- CVE-2023-24932
- Impact
- Security Feature Bypass
- Max Severity
- Important
- CVSS Source
- Microsoft
- Vector String
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
- Metrics
- CVSS:3.1 6.7 / 6.2Base score metrics: 6.7 / Temporal score metrics: 6.2
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Exploit Code Maturity
Functional
Remediation Level
Official Fix
Report Confidence
Confirmed
Please see Common Vulnerability Scoring System for more information on the definition of these metrics.
Exploitability
The following table provides an exploitability assessment for this vulnerability at the time of original publication.
- Publicly disclosed
- Yes
- Exploited
- Yes
- Exploitability assessment
- Exploitation Detected
FAQ
How can an attacker successfully exploit this vulnerability?
To exploit the vulnerability, an attacker who has physical access or Administrative rights to a target device could install an affected boot policy.
According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to compromise admin credentials on the device.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass Secure Boot.
Are there additional steps I need to take to be protected from this vulnerability?
The security update addresses the vulnerability by updating the Windows Boot Manager, but is not enabled by default. Additional steps are required at this time to mitigate the vulnerability. Please refer to the following for steps to determine impact on your environment: KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932.
I am running Window 11 23H2 or Server 2022, 23H2 Edition, What do I need to do to be protected from this vulnerability?
Protections for the Secure Boot bypass were included in Windows 11 Version 23H3 and Windows Server 2022, 23H2 Edition at the time of their release; however, these protections are not enabled by default. Customers running these versions of Windows must enable the protections as outlined in KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932.
Acknowledgements
- Zammis Clark
- Martin Smolar with ESET
- Tomer Sne-or with SentinelOne
Security Updates
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle.
- 10.0.26100.3194
- 10.0.26100.3194
- 10.0.26100.3194
- 10.0.26100.3194
- 10.0.25398.1009
- 10.0.22631.4890
- 10.0.22631.4890
- 6.3.9600.22074
- 6.3.9600.22074
- 6.2.9200.24975
- 6.2.9200.24975
- 6.1.7601.27219
- 6.1.7601.27219
- 6.1.7601.27219
- 6.1.7601.27219
- 6.0.6003.22769
- 6.0.6003.22769
- 6.0.6003.22769
- 6.0.6003.22769
- 6.0.6003.22769
- 6.0.6003.22769
- 6.0.6003.22769
- 6.0.6003.22769
- 10.0.14393.7159
- 10.0.14393.7159
- 10.0.14393.7159
- 10.0.14393.7159
- 10.0.10240.20710
- 10.0.10240.20710
- 10.0.19045.4651
- 10.0.19045.4651
- 10.0.19045.4651
- 10.0.22621.4890
- 10.0.22621.4890
- 10.0.19044.4651
- 10.0.19044.4651
- 10.0.19044.4651
- 10.0.22000.3079
- 10.0.22000.3079
- 10.0.19042.2965
- 10.0.19042.2965
- 10.0.20348.2582
- 10.0.20348.2582
- 10.0.17763.6054
- 10.0.17763.6054
- 10.0.17763.6054
Disclaimer
Revisions
The following updates have been made to CVE-2023-24932: 1) In the Security Updates table, added all supported versions of the following as they are affected by this vulnerability: Windows 11 24H2 and Windows Server 2025. 2) Further, to comprehensively address this vulnerability, Microsoft has released February 2025 security updates for all affected versions of Windows 11 version 22H2 and Windows 11 version 23H2.
Microsoft recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.
Updated the Security Updates table to include the July 9, 2024 updates. These updates include support for opting into an updated Secure Version Number to block older boot managers.
In the Security Updates table, added Windows 11 version 23H2 for x64-based systems and Windows 11 version 23H2 for ARM-based systems because the April 2024 security updates provide the latest mitigations. Note that these mitigations are off by default. Customers who should take additional steps to implement security mitigations for a publicly disclosed Secure Boot bypass leveraged by the BlackLotus UEFI bootkit and who would like to take a proactive security stance or to begin preparing for the rollout, please refer to KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support.
Updated FAQs to include information on how to be protected from this vulnerability for customers running Windows 11 23H2 or Windows Server 2022, 23H2 Edition. This is an informational change only.
Removed the Security Hotpatch Update for the July 2023 revision as that package doesn't exist for this release cycle. You must install the Security Update to get the updated software.
CORRECTED REVISION: To comprehensively address CVE-2023-24932, Microsoft has released July 2023 security updates for all affected versions of Microsoft Windows. Microsoft strongly recommends that customers install the updates to be fully protected from the vulnerability. Additional steps are required after the update is installed. See KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 for more information.
In the Security Updates table, added all supported versions of all supported versions of .NET Framework, Visual Studio 2022 version 17.0, Visual Studio 2022 version 17.2, and Visual Studio 2022 version 17.4 because these products are also affected by this vulnerability. Microsoft strongly recommends that customers running any of these products install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.
Information published.