Secure Boot Component Security Feature Bypass Vulnerability

<p>A security feature bypass vulnerability exists when Windows Secure Boot improperly loads a boot policy that is affected by the vulnerability. An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded onto a target device.</p> <p>To exploit the vulnerability, an attacker who has physical access or Administrative rights to a target device could install an affected boot policy.</p> <p>The security update addresses the vulnerability by revoking affected boot policies in the firmware. The revocation protection level depends upon platform firmware. The Windows event channel Microsoft-Windows-Kernel-Boot may be used to determine the protection level provided. Note that an additional reboot is needed to view the event:</p> <ul> <li>Windows versions prior to Windows 10 do not log the event by default. You must enable “analytic” logging for this channel prior to installation of the patch.</li> <li>Windows versions 10 and higher log the event by default. Event ID 155 indicates baseline protection. Event ID 154 indicates enhanced protection.</li> </ul> <p>For systems that provide baseline protection, firmware updates from your OEM may be available that upgrade systems to enhanced protection.</p>

Where it's fixed