PT-2025-1110 · Howyar+1 · Howyar Uefi Application "Reloader"+1

Martin Smolar + 1 · Published 2025-01-14 · Updated 2026-01-27 · CVE-2024-7344

Positive Technologies · (AI Summary)

CVSS v3.1

8.2

High

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Howyar UEFI Application "Reloader" (32-bit and 64-bit) versions prior to January 2025

Description A vulnerability exists in the Howyar UEFI Application "Reloader" that allows for the execution of unsigned software in a hardcoded path. This flaw, identified as CVE-2024-7344, bypasses UEFI Secure Boot protections, potentially enabling the installation of malicious bootkits. A new ransomware strain, HybridPetya, has been observed exploiting this vulnerability to gain persistence and encrypt systems. HybridPetya mimics the behavior of Petya/NotPetya ransomware, encrypting the NTFS Master File Table (MFT) and demanding a ransom payment. While HybridPetya has not yet been widely deployed in active attacks, its capabilities suggest a significant threat potential. The vulnerability resides in a UEFI application signed by Microsoft, impacting a range of systems. The exploitation of this vulnerability allows attackers to gain control at the boot level, potentially bypassing operating system-level security measures.

Recommendations Apply the January 2025 UEFI revocation database update. Check for the presence of the 'cloak.dat' file. Rotate Secure Boot keys if necessary. Apply updates for CVE-2024-7344. Ensure Secure Boot is enabled and properly configured. Monitor firmware integrity using tools like UEFI Scanner or CHIPSEC. Maintain offline backups of both data and firmware configurations.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-494

CWE-347

Related Identifiers

BDU:2025-00366

CVE-2024-7344

Affected Products

Howyar Uefi Application "Reloader"

Windows

References · 193

• 🔥 https://welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344 · Exploit
• https://uefi.org/revocationlistfile · Patch
• https://bdu.fstec.ru/vul/2025-00366 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7344 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-7344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7344 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7344 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-7344 · Vendor Advisory
• https://twitter.com/ESETresearch/status/1966427030041350159 · Twitter Post
• https://twitter.com/RedTeamNewsBlog/status/1904326539862233234 · Twitter Post
• https://twitter.com/TMJIntel/status/1879896152260145544 · Twitter Post
• https://kb.cert.org/vuls/id/529659 · Note
• https://twitter.com/FutureBoundIT1/status/1881386463465476153 · Twitter Post
• https://twitter.com/Twitchy426363/status/1880973042454860119 · Twitter Post
• https://twitter.com/WarrenTevora/status/1882075185630552064 · Twitter Post