CVE-2024-37972 Overview
CVE-2024-37972 is a Secure Boot security feature bypass vulnerability affecting supported versions of Microsoft Windows and Windows Server. The flaw allows an adjacent-network attacker to circumvent Unified Extensible Firmware Interface (UEFI) Secure Boot integrity checks when a user performs a required action. Successful exploitation compromises the trust chain established during system boot, enabling execution of unauthorized boot components. Microsoft addressed the issue in the July 2024 security update cycle.
Critical Impact
Bypassing Secure Boot allows attackers to load unsigned or malicious bootloaders and drivers, undermining kernel-level integrity guarantees and enabling persistent pre-OS implants such as bootkits.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-37972 published to the National Vulnerability Database (NVD)
- 2024-07-09 - Microsoft released security update guidance via MSRC
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37972
Vulnerability Analysis
CVE-2024-37972 is a Secure Boot bypass classified under [CWE-121] (Stack-based Buffer Overflow). The vulnerability resides in code executed during the UEFI Secure Boot verification path. An adjacent-network attacker who convinces a user to perform a specific action can bypass Secure Boot enforcement.
Exploitation impacts confidentiality, integrity, and availability at the platform level. Because Secure Boot underpins the trust chain of the entire operating system, a bypass permits loading of tampered boot components before Windows loads its kernel-mode protections.
Root Cause
Microsoft's advisory attributes the flaw to a stack-based memory-corruption condition in a boot-time component. Improper validation of size or length parameters during processing of boot-related data causes an out-of-bounds write on the stack, corrupting execution flow before OS-level defenses activate.
Attack Vector
The attack vector is adjacent network with low complexity, no privileges required, and required user interaction. An attacker within the same logical network segment must convince a targeted user to initiate a boot or update operation that triggers the vulnerable code path. Successful exploitation subverts Secure Boot policy and enables loading of unauthorized boot code.
No public proof-of-concept or in-the-wild exploitation has been reported, and the CVE is not listed on the CISA Known Exploited Vulnerabilities catalog. Microsoft's advisory should be consulted for technical specifics: Microsoft Security Update CVE-2024-37972.
Detection Methods for CVE-2024-37972
Indicators of Compromise
- Unexpected modifications to UEFI variables, the EFI System Partition (ESP), or bootmgfw.efi and bootmgr.efi files.
- Secure Boot policy transitions from enabled to disabled without a corresponding administrative change record.
- Presence of untrusted or unsigned boot loaders enumerated by bcdedit /enum firmware.
- Boot Configuration Data (BCD) entries pointing to non-standard paths on the ESP.
Detection Strategies
- Compare measured boot logs and Trusted Platform Module (TPM) Platform Configuration Register (PCR) values against a known-good baseline for each hardware model.
- Monitor Windows Event Log channel Microsoft-Windows-CodeIntegrity/Operational and boot-related events under System for signature validation failures.
- Alert on missing or superseded July 2024 cumulative updates across the Windows estate through configuration management telemetry.
Monitoring Recommendations
- Ingest boot integrity attestation data and Device Health Attestation (DHA) reports into a centralized security data lake for continuous evaluation.
- Correlate firmware-change telemetry with user session and network adjacency data to identify anomalous boot-time modifications.
- Track deployment status of Microsoft's July 2024 security updates by build number and reconcile against asset inventory.
How to Mitigate CVE-2024-37972
Immediate Actions Required
- Apply the July 2024 Microsoft cumulative security update to all affected Windows client and server builds without delay.
- Verify Secure Boot is enabled in firmware settings and enforced by policy on every managed endpoint.
- Restrict administrative access to firmware configuration and boot settings using platform passwords and management console controls.
- Audit removable media and network boot policies to reduce exposure to adjacent-network attack scenarios.
Patch Information
Microsoft addressed CVE-2024-37972 in the July 2024 Patch Tuesday release. Consult the Microsoft Security Update CVE-2024-37972 advisory for the specific KB article and build number corresponding to each supported Windows version, and deploy through Windows Update, Windows Server Update Services (WSUS), or Microsoft Intune.
Workarounds
- No official workaround replaces the security update; apply the vendor patch as the primary mitigation.
- Segment networks to limit adjacent-network reachability to sensitive endpoints and reduce the attackable population.
- Enforce user awareness controls to reduce the likelihood that targeted users perform the interaction required to trigger exploitation.
- Enable BitLocker with TPM and PIN protectors so that boot-integrity tampering invalidates key release and surfaces detectable failures.
# Verify Secure Boot status and enumerate firmware boot entries on Windows
Confirm-SecureBootUEFI
bcdedit /enum firmware
# Confirm the July 2024 cumulative update is installed (replace KB with the KB ID from the MSRC advisory for your build)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
