CVE-2024-37984: Windows 10 1507 Secure Boot Bypass Flaw

CVE-2024-37984 Overview

CVE-2024-37984 is a Secure Boot security feature bypass vulnerability affecting Microsoft Windows and Windows Server. The flaw is associated with a stack-based buffer overflow condition [CWE-121] within the Secure Boot code path. An attacker with local access can leverage this weakness to bypass Secure Boot integrity checks, undermining the platform trust chain established during boot.

Microsoft published the advisory on July 9, 2024. The vulnerability affects supported releases of Windows 10, Windows 11, and Windows Server from 2012 through 2022 23H2.

Critical Impact
A successful bypass of Secure Boot allows attackers with local access to compromise firmware-level trust, enabling persistent pre-OS code execution and undermining kernel integrity protections.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (21H2, 22H2, 23H2)
Microsoft Windows Server 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-07-09 - CVE-2024-37984 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37984

Vulnerability Analysis

CVE-2024-37984 is a Secure Boot bypass rooted in a stack-based buffer overflow [CWE-121]. Secure Boot validates firmware and bootloader components against a chain of cryptographic signatures before the operating system loads. A defect in this validation path allows an attacker to corrupt stack memory during early boot processing.

Exploitation requires local access with low complexity and does not require privileges or user interaction. The attack impacts confidentiality, integrity, and availability. A successful bypass allows unsigned or tampered code to execute before Windows kernel protections engage.

An attacker who bypasses Secure Boot can install bootkits, disable virtualization-based security (VBS), and persist below the operating system. This class of compromise is difficult to detect with traditional endpoint tooling because it executes before the OS kernel initializes.

Root Cause

The root cause is a stack-based buffer overflow in a Secure Boot component that processes boot-time data structures. Insufficient bounds checking permits crafted input to overwrite stack memory, corrupting return addresses or control data used during signature validation.

Attack Vector

The attack vector is local. An attacker must have the ability to execute code on the target system or manipulate boot artifacts on disk. Typical scenarios include an attacker with administrative access placing a malicious EFI binary, or physical access to the device to modify boot components. No verified public proof-of-concept code is available at this time. Refer to the Microsoft CVE-2024-37984 Advisory for authoritative technical details.

Detection Methods for CVE-2024-37984

Indicators of Compromise

Unexpected changes to EFI System Partition (ESP) contents, particularly unsigned or unknown .efi binaries under \EFI\Microsoft\Boot\.
Modifications to boot configuration data (BCD) entries or the presence of unknown boot loader entries.
Secure Boot state reporting as disabled or in setup mode on systems previously enrolled.
TPM Platform Configuration Register (PCR) values that deviate from known-good baselines after reboot.

Detection Strategies

Monitor Windows Event Log channels for Secure Boot policy changes and boot integrity failures, including events from Microsoft-Windows-Kernel-Boot and TPM-WMI.
Baseline EFI System Partition file hashes across fleet devices and alert on drift, especially for bootmgfw.efi and winload.efi.
Correlate measured boot data with TPM attestation results to identify hosts where the boot chain no longer matches expected values.
Track local privilege changes and file write activity targeting the ESP or Windows boot directories.

Monitoring Recommendations

Enable Device Health Attestation (DHA) or Windows Defender System Guard runtime attestation where supported to continuously validate boot integrity.
Ingest boot integrity telemetry and Windows Security event logs into a central data lake for cross-fleet analysis and long-term retention.
Alert on any process writing to the mounted ESP or invoking bcdedit.exe with parameters that alter boot loader configuration.

How to Mitigate CVE-2024-37984

Immediate Actions Required

Apply the July 2024 Microsoft security updates that address CVE-2024-37984 across all affected Windows and Windows Server versions.
Verify Secure Boot is enabled in firmware and confirm the Secure Boot policy is set to the Microsoft UEFI CA signed policy.
Audit local administrator accounts and restrict interactive logon rights on systems handling sensitive workloads.
Enroll systems in TPM-backed measured boot and validate PCR baselines after patching.

Patch Information

Microsoft released fixes as part of the July 9, 2024 Patch Tuesday cycle. Refer to the Microsoft CVE-2024-37984 Advisory for the complete list of KB updates aligned to each affected build. Deploy the applicable cumulative update, then reboot to complete Secure Boot component servicing.

Workarounds

Restrict physical and administrative access to endpoints, since exploitation requires local access.
Enable BitLocker with TPM+PIN protection to bind disk encryption to a verified boot state and detect unauthorized boot chain changes.
Deploy the Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI) policies to reduce the impact of pre-OS tampering.
Use UEFI firmware passwords and disable unnecessary boot devices to limit tampering opportunities.

bash

# Verify Secure Boot state on Windows
Confirm-SecureBootUEFI

# Review current Secure Boot policy
Get-SecureBootPolicy

# List boot loader entries for review
bcdedit /enum {bootmgr}