Security News > 2021 > January > Microsoft fixes Secure Boot bug allowing Windows rootkit installation
Microsoft has fixed a security feature bypass vulnerability in Secure Boot that allows attackers to compromise the operating system's booting process even when Secure Boot is enabled.
"An attacker who successfully exploited the vulnerability might bypass secure boot and load untrusted software," Microsoft explains.
To block untrusted or known vulnerable third-party bootloaders when Secure Boot is toggled on, Windows devices with UEFI firmware use the Secure Boot Forbidden Signature Database.
The KB4535680 security update released by Microsoft as part of the January 2021 Patch Tuesday addresses the vulnerability by blocking known vulnerable third-party UEFI modules to the DBX. Users have to install this standalone security update in addition to the normal security update to block attacks designed to exploit this Secure Boot vulnerability.
On systems where updates need to be installed manually, you will be required to first download KB4535680 for their platform from the Microsoft Update Catalog.
Microsoft also released guidance for applying Secure Boot DBX updates after the disclosure of the BootHole GRUB bootloader vulnerability in July 2020 which also allows for Secure Boot bypass.
News URL
Related news
- Microsoft fixes Windows Server 2022 bug breaking device boot (source)
- Microsoft says premature patch could make Windows Recall forget how to work (source)
- Microsoft says having a TPM is "non-negotiable" for Windows 11 (source)
- Microsoft lifts Windows 11 24H2 block on PCs with USB scanners (source)
- Microsoft says Auto HDR causes game freezes on Windows 11 24H2 (source)
- Microsoft adds another problem to the Windows 11 24H2 naughty list (source)
- Microsoft may have scrapped Windows 11's dynamic wallpapers feature (source)
- Microsoft to force install new Outlook on Windows 10 PCs in February (source)
- Microsoft 365 apps crash on Windows Server after Office update (source)
- Microsoft fixes actively exploited Windows Hyper-V zero-day flaws (source)