Detections
Analytics

Windows Security Feature Bypass in Secure Boot (BootHole)

high Nessus Plugin ID 139239

Language:

Synopsis

The remote Windows host is affected by multiple vulnerabilities.

Description

The remote Windows host is missing an update to the Secure Boot DBX. It is, therefore, affected by multiple vulnerabilities:

 - A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
 (CVE-2020-25632)

 - A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-20233)


Additionally, the host is affected by several other security feature bypasses in Secure Boot.

Note: Tenable is testing for the presence of the expected signatures added in the DBX update published on March 2, 2021 referenced in the vendor advisory.

Solution

Apply the DBX update from March 2, 2021 or later,

Install Microsoft KB5012170.

See Also

http://www.nessus.org/u?6f75665a

http://www.nessus.org/u?827c25cc

http://www.nessus.org/u?840ba26f

http://www.nessus.org/u?e51610a5

https://uefi.org/revocationlistfile/archive

Plugin Details

Severity: High

ID: 139239

File Name: windows_uefi_boothole.nbin

Version: 1.132

Type: local

Agent: windows

Family: Windows

Published: 7/31/2020

Updated: 11/12/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2021-20233

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.4

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows

Required KB Items: SMB/MS_Bulletin_Checks/Possible, SMB/Registry/Enumerated, SMB/WMI/Available

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/29/2020

Vulnerability Publication Date: 7/29/2020

Reference Information

CVE: CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-14372, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707, CVE-2020-25632, CVE-2020-25647, CVE-2020-27749, CVE-2020-27779, CVE-2021-20225, CVE-2021-20233, CVE-2021-3418

IAVA: 2020-A-0349