CVE-2024-29062 Overview
CVE-2024-29062 is a Secure Boot security feature bypass vulnerability affecting a broad range of Microsoft Windows client and server operating systems. The flaw stems from a race condition classified under [CWE-367] (Time-of-Check Time-of-Use). An attacker on an adjacent network can exploit the timing window to bypass Secure Boot integrity protections when a user performs a specific action.
Critical Impact
Successful exploitation allows an attacker to bypass Secure Boot, undermining the platform trust chain and enabling execution of unsigned or tampered boot components with high confidentiality, integrity, and availability impact.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 23H2
Discovery Timeline
- 2024-04-09 - CVE-2024-29062 published to the National Vulnerability Database
- 2024-04-09 - Microsoft released a security update addressing the vulnerability
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-29062
Vulnerability Analysis
CVE-2024-29062 is a Secure Boot bypass rooted in a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-367]. Secure Boot validates the cryptographic signature of boot components before allowing them to execute. The vulnerable code path checks a boot artifact at one moment and uses it at another, creating a narrow window in which the artifact can be substituted or modified.
An attacker who wins the race can load code that would otherwise be rejected by Secure Boot policy. This undermines the pre-OS integrity guarantee that downstream security controls, including measured boot and virtualization-based security, depend on.
Exploitation requires adjacent network access and user interaction, and the attack complexity is high. Despite these constraints, a successful bypass produces high impact across confidentiality, integrity, and availability because it compromises the platform trust root.
Root Cause
The root cause is a race condition in the Secure Boot validation logic. The vulnerable component verifies the state or content of a boot object and later consumes that object without re-validating it, allowing a concurrent operation to alter the object between the two operations.
Attack Vector
The attacker must be positioned on an adjacent network segment and must induce a user to perform a specific action, such as initiating a boot or update sequence. During the validation window, the attacker manipulates the referenced resource so that the trusted check applies to a benign object while the untrusted object is what actually gets executed.
No verified public proof-of-concept code is available for CVE-2024-29062. Refer to the Microsoft Security Update for CVE-2024-29062 for authoritative technical details.
Detection Methods for CVE-2024-29062
Indicators of Compromise
- Unexpected changes to Secure Boot policy variables or the UEFI DBX revocation database.
- Boot configuration data (BCD) modifications that reference unsigned or unknown loaders.
- Measured boot logs (TPM PCR values) that deviate from a known-good baseline after a reboot event.
- Presence of unsigned or unexpected .efi binaries in the EFI System Partition (ESP).
Detection Strategies
- Compare TPM PCR[0-7] measurements against a golden baseline and alert on drift.
- Monitor Windows Event Log channel Microsoft-Windows-Kernel-Boot for anomalous boot integrity events.
- Track EFI System Partition contents with file integrity monitoring, flagging new or modified boot loaders.
- Correlate adjacent-network activity with boot or firmware-update sequences on protected hosts.
Monitoring Recommendations
- Ingest boot integrity telemetry and firmware event logs into a centralized SIEM for cross-host correlation.
- Enforce Windows Defender System Guard attestation and alert on failed remote attestation reports.
- Audit patch compliance for the April 2024 Windows security update across all affected SKUs.
How to Mitigate CVE-2024-29062
Immediate Actions Required
- Apply the April 2024 Microsoft security update for CVE-2024-29062 to all affected Windows 10, Windows 11, and Windows Server systems.
- Verify Secure Boot is enabled in firmware and confirm the update rolled forward on every affected host.
- Refresh Secure Boot baseline measurements and re-establish golden PCR values after patching.
Patch Information
Microsoft published the fix through the Microsoft Security Response Center. Consult the Microsoft Security Update for CVE-2024-29062 advisory for KB article numbers specific to each Windows build. Deploy the update through Windows Update, WSUS, or Microsoft Update Catalog. Server operating systems, including Windows Server 2012 through 2022 and 23H2, require the corresponding cumulative update for their respective service channel.
Workarounds
- Restrict adjacent-network access to trusted hosts using network segmentation and 802.1X where feasible.
- Require user awareness training so operators do not initiate boot or update sequences on untrusted networks.
- Enforce full-disk encryption bound to TPM and PCR values so that a Secure Boot bypass invalidates the sealed key.
- Where patching is delayed, prioritize deployment on domain controllers, certificate authorities, and other high-value assets first.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
