CVE-2024-7344

Published Jan 14, 2025

Last updated 8 months ago

Howyar Reloader

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-7344 affects a "Reloader" UEFI application (32-bit and 64-bit) from Howyar. The vulnerability stems from the application's use of a custom PE loader instead of standard UEFI functions. This allows the execution of unsigned software from a hardcoded path, specifically from a specially crafted file named "cloak.dat". Successful exploitation of CVE-2024-7344 allows an attacker to bypass UEFI Secure Boot and execute untrusted code during system boot. This can lead to the deployment of malicious UEFI bootkits, even on systems with UEFI Secure Boot enabled. The vulnerability has been fixed by affected vendors, and Microsoft revoked the vulnerable binaries in the January 14, 2025 Patch Tuesday update.

Description: Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.
Source: cret@cert.org
NVD status: Analyzed
Products: neo_impact, greenguard, sysreturn, smart_recovery, ez-back_system, hdd_king, erecoveryrx

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.2
Impact score: 6
Exploitability score: 1.5
Vector string: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-347

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cs-grp:neo_impact:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "661C4664-9989-497C-9758-595D667A5E61",
            "versionEndExcluding": "10.1.024-20241127"
          },
          {
            "criteria": "cpe:2.3:a:greenware:greenguard:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C26295FA-07B6-42D8-B5E9-7B54FA3D4559",
            "versionEndExcluding": "10.2.023-20240927"
          },
          {
            "criteria": "cpe:2.3:a:howyar:sysreturn:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "070699E9-BA08-4DFA-B2D7-61289CFDF865",
            "versionEndExcluding": "10.2.023_20240919"
          },
          {
            "criteria": "cpe:2.3:a:radix:smart_recovery:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E1D9F1B3-11C7-47FC-972C-017869712582",
            "versionEndExcluding": "11.2.023-20240927"
          },
          {
            "criteria": "cpe:2.3:a:sanfong:ez-back_system:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A794B06A-1AAC-49D4-8AD5-813A84B6DA60",
            "versionEndExcluding": "10.3.024-20241127"
          },
          {
            "criteria": "cpe:2.3:a:signalcomputer:hdd_king:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FD9C4071-6E0B-472B-89BB-88D324D47534",
            "versionEndExcluding": "10.3.021-20241127"
          },
          {
            "criteria": "cpe:2.3:a:wasay:erecoveryrx:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DDA5BBD9-2DCD-4F4B-94A2-28E62180ADA3",
            "versionEndExcluding": "8.4.022-20241127"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.