CVE-2022-34301

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.

CVSS v3.1 NVD

6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.98% chance of exploitation in the next 30 days, 61st percentile

Published

2022-08-26

Updated

2024-08-03

Proof-of-concept exploits (1)

• TheMalwareGuardian/CVE-2022-343011★ · 2026-09-11

Security advisories

• https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-chain/secure_boot_chain_i…
• https://www.kb.cert.org/vuls/id/309662

References

• CVE Record
• NVD entry

Related

• CVE-2002-1120
• CVE-2003-0264
• CVE-2007-1567
• CVE-2017-14980
• CVE-2018-14847
• CVE-2018-18912