Does Microsoft Intend to Release An Updated KB for the March 2023 Security Feature Bypass in GRUB Vulnerability?

Question

Does Microsoft Intend to Release An Updated KB for the March 2023 Security Feature Bypass in GRUB Vulnerability?

BigPixFix 20

Microsoft last released a patch for Security Feature Bypass in GRUB in August 2022 ( KB512710). Recently, a new UEFI revocation file (March 2023) was added as per vendor https://uefi.org/revocationlistfile. With the release of the new March 2023 UEFI revocation file, there may be a gap in security for this vulnerability between the August update and the March revocation file. Does Microsoft plan to provide a new update to cover this security flaw?

1 answer

Your answer

Answer 1

Limitless Technology 44,766

Hello,

Initially the KB5012170 replaces GRUB with GRUB 2.06 which is a version that doesn't contain the vulnerabilities.

The March update contains different vulnerability patches for GRUB versions prior to 2.06, released at the moment that were detected but combined in March 2023 updated for spread distribution.

You can have more information about the updates on the releases releases at:

https://msrc.microsoft.com/update-guide/vulnerability/ADV200011

--If the reply is helpful, please Upvote and Accept as answer--

BigPixFix 20 Reputation points

2023-05-03T16:22:55.13+00:00

Hi @limitless Thanks for the quick reply. Let me clarify. I think you are referring to the March 2021 update. There was a new list of vulnerabilities /CVEs added in March 2023 (last month), that is not mentioned in the ADV200011 (https://msrc.microsoft.com/update-guide/vulnerability/ADV200011) .

The new revocation list/CVE is mentioned here https://uefi.org/revocationlistfile

Do you know if Microsoft is going to address the new revocation list and related CVEs with an update?
BigPixFix 20 Reputation points

2023-05-03T16:25:17.7266667+00:00

Hi @limitless Thanks for the quick reply. I think you are referring to the March 2021 update. There was a new list of vulnerabilities /CVEs added in March 2023 (last month), that is not mentioned in the ADV200011 (https://msrc.microsoft.com/update-guide/vulnerability/ADV200011) .

The new revocation list/CVE is mentioned here https://uefi.org/revocationlistfile

Do you know if Microsoft is going to address the new revocation list and related CVEs with an update?

Share via

Does Microsoft Intend to Release An Updated KB for the March 2023 Security Feature Bypass in GRUB Vulnerability?

1 answer

Your answer