ADV230002High

Microsoft Guidance for Addressing Security Feature Bypass in Trend Micro EFI Modules

Published
July 11, 2023
Last Modified
—

🔗 CVE IDs covered (1)

ADV230002 · pending

📋 Description

Trend Micro has released CVE-2023-28005 to address a secure boot bypass. Subsequently Microsoft has released the July Windows security updates to block the vulnerable UEFI modules by using the DBX (UEFI Secure Boot Forbidden Signature Database) disallow list. To exploit this vulnerability, an attacker would need to have administrative privileges or physical access on a system where Secure Boot is configured to trust the Microsoft Unified Extensible Firmware Interface (UEFI) Certificate Authority (CA). CVEs released for this issue: CVE-2023-28005. Recommended Actions: Microsoft recommends that all customers install the latest Windows security updates. Background Information In 2012, Microsoft introduced the Secure Boot feature into the then-new, UEFI-based PC ecosystem.  UEFI Secure Boot is an anti-rootkit feature that defends the boot process from untrusted code execution.  As part of enabling this feature, Microsoft signs boot code both for Windows and 3rd-parties including Linux distributions. This boot code allows Linux systems to take advantage of Secure Boot. What is UEFI? UEFI (Unified Extensible Firmware Interface) defines the interactions between the operating system and the platform firmware. The Secure Boot feature of UEFI prevents the loading of operating system loaders and firmware drivers that are not signed by a trusted signature. What is DBX? DBX is the Forbidden Signature Database and tracks the revoked boot images.

🎯 Affected products27

  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2022 (Server Core installation)

✅ Remediation

KB5028168 (Security Update) — fixed build 10.0.17763.4645 KB5028171 (Security Update) — fixed build 10.0.20348.1850 KB5028182 (Security Update) — fixed build 10.0.22000.2176 KB5028166 (Security Update) — fixed build 10.0.19044.3208 KB5028185 (Security Update) — fixed build 10.0.22621.1992 KB5028166 (Security Update) — fixed build 10.0.19045.3208 KB5028186 (Security Update) — fixed build 10.0.10240.20048 KB5028169 (Security Update) — fixed build 10.0.14393.6085 KB5028232 (Monthly Rollup) — fixed build 6.2.9200.24374 KB5028233 (Security Only) — fixed build 6.2.9200.24374 KB5028228 (Monthly Rollup) — fixed build 6.3.9600.21063 KB5028223 (Security Only) — fixed build 6.3.9600.21075

🔗 References (16)