BlackLotus Secure Boot Security Feature Bypass

CVE-2023-24932 is a Microsoft Windows Secure Boot security feature bypass vulnerability associated with the boot path weaknesses leveraged by the BlackLotus UEFI bootkit. The provided context states Microsoft released security updates in May 2023 to address this Secure Boot zero-day and that it was used to bypass protections related to the earlier Baton Drop issue (CVE-2022-21894). The issue affects the trust model for Windows boot components: vulnerable or older signed Windows boot loaders/boot managers remained trusted by Secure Boot, allowing an attacker to replace a fully patched boot loader with a vulnerable version and use the unsecured boot path to defeat Secure Boot policy enforcement before Windows fully loads. Microsoft’s remediation required not only OS updates but also a staged process involving updated boot managers, Secure Boot database changes, and revocations, because revoking vulnerable boot components incorrectly could render systems unbootable.