CVE-2024-7344: Cs-grp Neo Impact RCE Vulnerability

CVE-2024-7344 Overview

CVE-2024-7344 is a critical UEFI Secure Boot bypass vulnerability affecting the Howyar UEFI Application "Reloader" (both 32-bit and 64-bit versions). The vulnerability allows execution of unsigned software from a hardcoded path, effectively bypassing UEFI Secure Boot protections. This flaw enables attackers with local privileged access to load and execute malicious code during the boot process, potentially installing persistent bootkits that survive operating system reinstallation.

Critical Impact
This vulnerability enables attackers to bypass UEFI Secure Boot protections, allowing execution of unsigned malicious code during the boot process with full system compromise potential.

Affected Products

Howyar SysReturn
CS-GRP Neo Impact
Greenware GreenGuard
Radix Smart Recovery
Sanfong EZ-back System
SignalComputer HDD King
Wasay eRecoveryRX

Discovery Timeline

January 14, 2025 - CVE-2024-7344 published to NVD
January 22, 2025 - Last updated in NVD database

Technical Details for CVE-2024-7344

Vulnerability Analysis

This vulnerability (CWE-347: Improper Verification of Cryptographic Signature) resides in the UEFI application "Reloader" used by multiple system recovery and backup software products. The application fails to properly verify cryptographic signatures before executing binaries, allowing unsigned code to run during the boot process.

The vulnerability is particularly dangerous because it affects the pre-boot environment where traditional security controls are not yet active. An attacker with high privileges on the local system can exploit this flaw to execute arbitrary unsigned code, completely undermining the trust chain that Secure Boot is designed to protect.

Root Cause

The root cause is improper verification of cryptographic signatures (CWE-347) in the Reloader UEFI application. The application contains a hardcoded path from which it loads and executes binaries without verifying their digital signatures. This design flaw violates the fundamental principle of UEFI Secure Boot, which requires all boot-time code to be cryptographically signed by a trusted authority.

The affected UEFI application was signed by Microsoft's third-party UEFI Certificate Authority, giving it the ability to run on systems with Secure Boot enabled. However, the application's internal mechanism for loading additional code bypasses signature verification entirely.

Attack Vector

Exploitation requires local access with high privileges. An attacker must:

Gain administrative/root access to the target system
Place a malicious unsigned binary at the hardcoded path used by the vulnerable Reloader application
Ensure the vulnerable UEFI application is present in the boot chain
Reboot the system to trigger execution of the unsigned malicious code

The vulnerability enables installation of UEFI bootkits that execute before the operating system loads, providing attackers with:

Persistence that survives OS reinstallation
Complete control over the boot process
Ability to hide from OS-level security tools
Potential to disable security features during boot

For detailed technical analysis, see ESET Research on CVE-2024-7344.

Detection Methods for CVE-2024-7344

Indicators of Compromise

Presence of vulnerable UEFI applications from affected vendors in the EFI System Partition
Unexpected or unsigned binaries in hardcoded paths used by Reloader applications
Modified boot configuration pointing to vulnerable UEFI applications
Anomalous UEFI boot entries or unexpected changes to boot order

Detection Strategies

Monitor EFI System Partition for unauthorized modifications or suspicious binaries
Implement UEFI firmware integrity monitoring to detect tampering with boot components
Use endpoint detection tools capable of scanning pre-boot environments
Review boot entries and UEFI variables for signs of unauthorized modification
Deploy solutions that verify UEFI application signatures before execution

Monitoring Recommendations

Enable UEFI Secure Boot logging where available and monitor for boot failures or violations
Implement file integrity monitoring on the EFI System Partition
Monitor for installation of affected recovery software products
Track changes to UEFI boot variables through Windows Event logs or platform-specific mechanisms

How to Mitigate CVE-2024-7344

Immediate Actions Required

Update the UEFI revocation list (dbx) to include the vulnerable signed binaries
Remove or update affected recovery software products to patched versions
Audit systems for presence of vulnerable UEFI applications
Verify Secure Boot is enabled and the revocation list is current

Patch Information

Microsoft has released an updated UEFI revocation list that blocks the vulnerable signed UEFI applications. Organizations should apply the latest Windows security updates and ensure the UEFI dbx (forbidden signature database) is current.

Affected vendors have been notified, and updated versions of the recovery software should be obtained directly from the respective vendors. The UEFI Revocation List File contains the latest revocations that should be applied to block vulnerable applications.

Additional technical details are available in CERT Vulnerability Note #529659.

Workarounds

If immediate patching is not possible, remove the vulnerable recovery software applications from affected systems
Manually update the UEFI dbx database using tools provided by your system manufacturer
Implement strict access controls to prevent unauthorized users from modifying boot configurations
Consider enabling additional UEFI security features like Trusted Boot where supported

bash

# Verify Secure Boot status on Linux systems
mokutil --sb-state

# List current UEFI Secure Boot configuration
efibootmgr -v

# Check for presence of vulnerable applications in EFI partition
find /boot/efi -name "*.efi" -exec sha256sum {} \;