Is there another fix KB for the Secure Boothole vulnerability?

marshan32 35

A few months back, KB5012170 was released to fix a vulnerability in Windows Security Feature Bypass in Secure Boot (BootHole). We've installed this fix KB via SCCM and Powershell and confirmed that it is actually installed. However, Tenable is still detecting that the device is vulnerable as it sees the KB is "missing". We have tried to remove and re-install it but Tenable scan result is still the same. Any suggestion on how to properly install this fix KB?

Aaron Fleck 0 Reputation points

2023-04-26T12:38:02.0433333+00:00

I also have these being pushed through SCCM. My org has 3 Dell Optiplex micro desktops coming up on Tenable for this. I did the test script on those, the micro on my desk, as well as my Latitude laptop all showing "TRUE" (though only the other 3 are in Tenable for it). I am trying to do the manual fix, but it seems the DBX Split script has been removed from the gallery which ALL documentation references.

At this point I don't have evidence to take to leadership that we have a path forward. Suggestions?

Accepted answer

Reza-Ameri 17,011 Reputation points

2023-04-03T15:59:29.3766667+00:00

It might be a false-positive and you will need to check with their support.
Please sign in to rate this answer.
BigPixFix 20 Reputation points

2023-05-02T17:05:23.81+00:00

This is not a False-Positive. An update was made to the list of untrusted certs that should not be allowed. In the course of time that is expected. There is a new UEFI revocation file dated March 2023.

BigPixFix 20 Reputation points

2023-05-02T17:06:30.4866667+00:00

Does Microsoft intend to send out another update?

Rouge 10 Reputation points

2023-05-10T12:55:44.6766667+00:00

I have tested this March 2023 on a Windows 11 machine. When you run the test to see if it was applied and it is resolved; you get back several errors.

"Byte array for GUID must be exactly 16 bytes long" then the output of "Warning: !!! Not Found" and "Warning: !!! Fail: 2 failures Detected" (which is part of the script with the warning output).
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

Otha 0 Reputation points

2023-05-01T18:32:48.7333333+00:00

There's a new UEFI revocation file (March 2023) and I think that's what's causing the BootHole vulnerability to re-appear. I downloaded it and split it using the DBX split script and ran the Set-SecureBootUefi command against the output and that fixed the vulnerability for me. However, I expect BootHole will appear again once a new UEFI revocation file is posted...I was hoping the fix Microsoft posted would be a permanent one but apparently not...
Please sign in to rate this answer.
Rouge 10 Reputation points

2023-05-10T12:55:55.1+00:00

I have tested this March 2023 on a Windows 11 machine. When you run the test to see if it was applied and it is resolved; you get back several errors.

"Byte array for GUID must be exactly 16 bytes long" then the output of "Warning: !!! Not Found" and "Warning: !!! Fail: 2 failures Detected" (which is part of the script with the warning output).

anil suthar 1 Reputation point

2023-06-23T07:36:08.3833333+00:00

Any idea when microsoft is going to release new patch to fix this vulnerability, as i have similar issue. After applying latest file through the script as mentioned in guidelines, Nessus doesn't report it again. However i've findings of this for 400 virtual servers and since Microsoft is there to provide fixes through patch why we need to push this through script or manual work ? Just thought, anyone has a better solution please let me know how to proceed
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Is there another fix KB for the Secure Boothole vulnerability?

1 additional answer

Your answer