CVE-2024-7344: Cs-grp Neo Impact RCE Vulnerability

CVE-2024-7344 Overview

CVE-2024-7344 is a critical UEFI Secure Boot bypass vulnerability affecting the Howyar UEFI Application "Reloader" (both 32-bit and 64-bit versions). The vulnerability allows execution of unsigned software from a hardcoded path, effectively bypassing UEFI Secure Boot protections. This flaw enables attackers with local privileged access to load and execute malicious code during the boot process, potentially installing persistent bootkits that survive operating system reinstallation.

Critical Impact

This vulnerability enables attackers to bypass UEFI Secure Boot protections, allowing execution of unsigned malicious code during the boot process with full system compromise potential.

Affected Products

• Howyar SysReturn
• CS-GRP Neo Impact
• Greenware GreenGuard
• Radix Smart Recovery
• Sanfong EZ-back System
• SignalComputer HDD King
• Wasay eRecoveryRX

Discovery Timeline

• January 14, 2025 - CVE-2024-7344 published to NVD
• January 22, 2025 - Last updated in NVD database

Technical Details for CVE-2024-7344

Vulnerability Analysis

This vulnerability (CWE-347: Improper Verification of Cryptographic Signature) resides in the UEFI application "Reloader" used by multiple system recovery and backup software products. The application fails to properly verify cryptographic signatures before executing binaries, allowing unsigned code to run during the boot process.

The vulnerability is particularly dangerous because it affects the pre-boot environment where traditional security controls are not yet active. An attacker with high privileges on the local system can exploit this flaw to execute arbitrary unsigned code, completely undermining the trust chain that Secure Boot is designed to protect.

Root Cause

The root cause is improper verification of cryptographic signatures (CWE-347) in the Reloader UEFI application. The application contains a hardcoded path from which it loads and executes binaries without verifying their digital signatures. This design flaw violates the fundamental principle of UEFI Secure Boot, which requires all boot-time code to be cryptographically signed by a trusted authority.

The affected UEFI application was signed by Microsoft's third-party UEFI Certificate Authority, giving it the ability to run on systems with Secure Boot enabled. However, the application's internal mechanism for loading additional code bypasses signature verification entirely.

Attack Vector

Exploitation requires local access with high privileges. An attacker must:

1. Gain administrative/root access to the target system
2. Place a malicious unsigned binary at the hardcoded path used by the vulnerable Reloader application
3. Ensure the vulnerable UEFI application is present in the boot chain
4. Reboot the system to trigger execution of the unsigned malicious code

The vulnerability enables installation of UEFI bootkits that execute before the operating system loads, providing attackers with:

• Persistence that survives OS reinstallation
• Complete control over the boot process
• Ability to hide from OS-level security tools
• Potential to disable security features during boot

For detailed technical analysis, see ESET Research on CVE-2024-7344.

Detection Methods for CVE-2024-7344

Indicators of Compromise

• Presence of vulnerable UEFI applications from affected vendors in the EFI System Partition
• Unexpected or unsigned binaries in hardcoded paths used by Reloader applications
• Modified boot configuration pointing to vulnerable UEFI applications
• Anomalous UEFI boot entries or unexpected changes to boot order

Detection Strategies

• Monitor EFI System Partition for unauthorized modifications or suspicious binaries
• Implement UEFI firmware integrity monitoring to detect tampering with boot components
• Use endpoint detection tools capable of scanning pre-boot environments
• Review boot entries and UEFI variables for signs of unauthorized modification
• Deploy solutions that verify UEFI application signatures before execution

Monitoring Recommendations

• Enable UEFI Secure Boot logging where available and monitor for boot failures or violations
• Implement file integrity monitoring on the EFI System Partition
• Monitor for installation of affected recovery software products
• Track changes to UEFI boot variables through Windows Event logs or platform-specific mechanisms

How to Mitigate CVE-2024-7344

Immediate Actions Required

• Update the UEFI revocation list (dbx) to include the vulnerable signed binaries
• Remove or update affected recovery software products to patched versions
• Audit systems for presence of vulnerable UEFI applications
• Verify Secure Boot is enabled and the revocation list is current

Patch Information

Microsoft has released an updated UEFI revocation list that blocks the vulnerable signed UEFI applications. Organizations should apply the latest Windows security updates and ensure the UEFI dbx (forbidden signature database) is current.

Affected vendors have been notified, and updated versions of the recovery software should be obtained directly from the respective vendors. The UEFI Revocation List File contains the latest revocations that should be applied to block vulnerable applications.

Additional technical details are available in CERT Vulnerability Note #529659.

Workarounds

• If immediate patching is not possible, remove the vulnerable recovery software applications from affected systems
• Manually update the UEFI dbx database using tools provided by your system manufacturer
• Implement strict access controls to prevent unauthorized users from modifying boot configurations
• Consider enabling additional UEFI security features like Trusted Boot where supported

# Verify Secure Boot status on Linux systems
mokutil --sb-state

# List current UEFI Secure Boot configuration
efibootmgr -v

# Check for presence of vulnerable applications in EFI partition
find /boot/efi -name "*.efi" -exec sha256sum {} \;