CVE-2024-37974 Overview
CVE-2024-37974 is a Secure Boot security feature bypass vulnerability affecting multiple versions of Microsoft Windows and Windows Server. The flaw allows an adjacent attacker to circumvent Secure Boot integrity checks when a user interacts with a crafted component. Microsoft disclosed the issue on July 9, 2024, and it carries a CVSS 3.1 base score of 8.0. The underlying weakness maps to [CWE-191] Integer Underflow, which can be leveraged to defeat firmware-level trust boundaries. Successful exploitation compromises confidentiality, integrity, and availability of the boot process.
Critical Impact
An attacker bypassing Secure Boot can load unsigned or malicious code during system startup, undermining the platform's root of trust and enabling persistent pre-OS implants such as bootkits.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-37974 published to NVD
- 2024-07-09 - Microsoft releases security advisory and patch guidance
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37974
Vulnerability Analysis
CVE-2024-37974 is a Secure Boot bypass rooted in an integer underflow condition [CWE-191] within Windows boot components. Secure Boot is a UEFI feature that validates the cryptographic signatures of bootloaders and early kernel components before execution. When the underflow occurs, size or length calculations wrap to unintended values, allowing crafted boot data to escape signature enforcement.
An attacker with adjacent network access and the ability to induce user interaction can deliver a manipulated boot artifact. The result is execution of untrusted code before operating system defenses initialize. This class of flaw undermines measured boot chains, disk encryption bindings such as BitLocker, and virtualization-based security assumptions.
Root Cause
The vulnerability originates from improper arithmetic handling in a boot-time component. An integer underflow produces an undersized or malformed length value that downstream logic treats as valid, bypassing the signature validation path that Secure Boot normally enforces.
Attack Vector
Exploitation requires adjacent network positioning and user interaction. An attacker typically stages a crafted boot image or update artifact and convinces the target to boot or process it. No authentication is required. Once the underflow triggers, malicious pre-boot code executes with firmware privilege, enabling bootkit installation and tamper of measured boot logs.
No verified public proof-of-concept code is available for CVE-2024-37974. See the Microsoft CVE-2024-37974 Advisory for vendor-specific technical detail.
Detection Methods for CVE-2024-37974
Indicators of Compromise
- Unexpected modifications to EFI System Partition (ESP) files such as bootmgfw.efi, bootx64.efi, or vendor bootloader binaries.
- Discrepancies between expected and observed PCR (Platform Configuration Register) values reported by the TPM during measured boot.
- New or unsigned entries in UEFI boot order variables (BootOrder, BootXXXX) that were not provisioned by administrators.
- Windows Event Log entries in Microsoft-Windows-TPM-WMI or BitLocker recovery prompts appearing after routine reboots.
Detection Strategies
- Compare TPM measured boot logs against a known-good baseline to identify hash mismatches in early boot components.
- Monitor endpoint telemetry for writes to the EFI System Partition originating from user-mode processes or unexpected installers.
- Correlate Secure Boot policy changes and DBX (revoked signatures database) updates with authorized patch management activity.
Monitoring Recommendations
- Ingest UEFI, TPM, and boot integrity events into a centralized SIEM for baseline deviation analysis.
- Alert on BitLocker recovery key prompts fleet-wide, which often signal boot chain tampering.
- Track Windows Update installation status for the July 2024 and later cumulative updates across all managed endpoints.
How to Mitigate CVE-2024-37974
Immediate Actions Required
- Apply the July 2024 (and later) Microsoft cumulative security updates to all affected Windows client and Windows Server systems.
- Verify Secure Boot is enabled in UEFI firmware and that the DBX revocation list is current on every endpoint.
- Prioritize patching for internet-facing servers, domain controllers, and systems that process removable or externally supplied boot media.
Patch Information
Microsoft addressed CVE-2024-37974 through the July 2024 Patch Tuesday cumulative updates for Windows 10, Windows 11, and Windows Server. Refer to the Microsoft CVE-2024-37974 Advisory for the exact KB articles corresponding to each affected build. Apply updates through Windows Update, WSUS, or Microsoft Endpoint Configuration Manager per organizational patch policy.
Workarounds
- No official workaround replaces the patch. Restrict physical and adjacent network access to systems that cannot be immediately updated.
- Enforce BitLocker with TPM+PIN protection to increase the cost of pre-boot tampering.
- Disable booting from removable media in UEFI firmware and require administrator authentication to change boot order.
# Verify Secure Boot status and installed updates on Windows
Confirm-SecureBootUEFI
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
