Additional guidance for devices using Secure Boot to address CVE-2023-24932

hsehestedt · Jul 31, 2023

Bree, your results are interesting. I didn't think that this particular issue would affect media built with WinRE. I thought that it would only affect the WinPE based media.

I do realize that there is the SafeOS update for WinRE, but I thought that that was for addressing (finally!) the previous WinRE issue. In other words, 2 separate issues.

I'll have to look into this further as my brain hurts right now

Bree · Jul 31, 2023

hsehestedt said:
I didn't think that this particular issue would affect media built with WinRE. I thought that it would only affect the WinPE based media.

This issue affects anything that you want to boot from, be that WinPE, WinRE or even Windows itself. If you restore an image of Windows that was made before the May 9th update then with revocations deployed it won't boot with secure boot enabled. That what MS mean by "If you use backup software to save the contents of your Windows installation into a recovery image, be sure to run a complete backup after installing the Windows updates released on or after May 9, 2023."

WinRE is not mentioned explicitly, but is implicated by association in the documentation. A Recovery Drive boots using WinRE, and MS said: "Note: The “Create a recovery drive” functionality is not supported in the updates released on or after May 9, 2023, and cannot be used to restore devices with revocation enabled. We are working on a resolution and will provide an update in an upcoming release." That fix in an 'upcoming release' looks like it was the SafeOS update for WinRE in the July 11 update. A recovery drive made now should work again, as does building new WinRE Reflect rescue media.

MiguelAngel11 · Jul 31, 2023

My congrats also for providing the batch files

hsehestedt · Jul 31, 2023

I'll see if I can confirm this, but here's what I think is happening:

You will recall the previous issue related to WinRE (not PE). My apologies for not referencing the thread to that issue at the moment. I just don't have the time right now. But at the time, Microsoft noted that they would be coming out with Safe OS updates (WinRE) at a later date. That later date seems to have been the July updates. In fact, I know for a fact that I read that in a release note somewhere.

The issue revolving around the revocations specifically affects WinPE and not RE. However, it so happens that there were updates for both in the July update packages.

It's possible that I may be tied up for the next day with not a lot of time to devote to this, but I'll try to get a detailed summary as soon as I can.

If in my research I determine that I'm completely wrong on this for some reason, I will note that. I have no problem admitting if I have this wrong, but I'm fairly certain about this.

As I noted, just be patient with me since this will take me some time.

Ghot · Jul 31, 2023

hsehestedt said:
As I noted, just be patient with me since this will take me some time.

No worries. Microsoft says they won't get this all cleared up until 2024. So you've got limp competition.

Scott · Aug 1, 2023

Bree said:
As hoped for, the newly built Reflect Recovery USB boots perfectly normally with Secure Boot enabled.

Build: 22621.2070
Secure Boot: Enabled
Revocations: Applied
Reflect Recovery USB: It boots!

On my one-time F8 boot menu my USB shows 2 partitions. Partition 1 wouldn't boot, but partition 2 booted without issue.
Now we don't need to disable Secure Boot to load Reflect Recovery from USB.

Thanks Bree

Bastet · Aug 1, 2023

I’ve created Reflect recovery USB with PE by following Macrium’s post on their forum. Has anyone tried their suggestions to see if it works or do I need to re-do the rescue media to use WindowsRE?

xrms3 · Aug 1, 2023

@Bastet
I've just followed their instructions, downloaded the updated WinPE files and rebuilt the rescue media and it works fine on a revoked pc.

Since their WinPE works and so do @hsehestedt's batch files, the question is academic but I can't get WinRE-based media to work at all - not that I need it, just out of interest.
I've created WinRe rescue media on one revoked and one unrevoked pc. Both up-to-date Win 11 22H2; both rebuilt WinRE files. Both USBs work on the unrevoked pc; both fail on the revoked one. Cannot see what is different. Too much spare time for fooling around, I suppose!

Bastet · Aug 1, 2023

Thanks @xrms3 good to know the PE will work after the revocation Is added.

hsehestedt · Aug 1, 2023

I was wrong.

Back when KB5022303 first came out, I'm pretty sure that there was no reference to WinRE. Now, it's like, "oh, by the way, there is a Safe OS Dynamic Update available to update WinRE" (obviously not a direct quote, me being punchy and annoyed with myself for not keeping up).

Another part of the problem was that WinRE just worked for me because I am already in the habit of updating WinRE with every new update as soon as it is released.

You see, I wrote myself a program that updates EVERYTHING including the install.wim, winRE, WinPE, and even the parts of a Windows distribution not contained in any image. So, for me, WinRE just worked.

So, thanks to all of you for this discussion making me revisit the topic and re-read everything. @Bree - your info was a big part of getting me to realize I had something wrong in my thick skull.

I'm going to write up some very detailed notes mainly to help me keep all of this straight in my own head. If it's not down in writing I will get confused as I have already demonstrated. I'll be happy to share if anyone is interested when I am done.

Just a brief summary with no details:

Issue 1: KB5022303 and CVE-2022-41099 are related to the WinRE issue on deployed devices.

Issue 2: KB5025885 and CVE-2023-24932 are related to the Black Lotus issue. We now know that not only is WinPE affected by this, but so is WinRE.

How on earth does your average home PC user who sees the PC as an appliance deal with this stuff?

BobD · Aug 1, 2023

hsehestedt said:
How on earth does your average home PC user who sees the PC as an appliance deal with this stuff?

I'm slightly better than your average but I'm not up with you guys and I'm struggling with this.

Ghot · Aug 1, 2023

Here's Macrium's fix for this latest of MS fiascos. Pretty nice article with instructions...

KB5028254 breaks the Macrium bootable media.

And you have revocations applied? Anything will boot without revocations applied. Oh. I didn't realize that the BIG question here was whether or not you had revocations applied. I must not have read the previous 35+ posts carefully enough. I thought the problem was the UPDATE disabling Macrium...

www.elevenforum.com

no1yak · Aug 2, 2023

I had a go at this revocation setting and all went well (or so I thought). Checked event viewer and found the 276 entry Windows boot manager revocation policy version 0x2000000000002 is applied, but no event 1035 in system. Anyone shed any light on this, cos I haven't a clue.
Win ver 22H2 2070 so it's up to date.

Bree · Aug 2, 2023

hsehestedt said:
@Bree - your info was a big part of getting me to realize I had something wrong.....
....How on earth does your average home PC user who sees the PC as an appliance deal with this stuff?

With luck the average home PC user isn't going to notice. No average user is going to apply the revocations themselves, and MS aren't intending to enforce them until 2024 Q1.

When would this 'average' user need to boot from a USB? If it was to reinstall Windows then they'd be downloading the latest install media, and that can already boot with the revocations in place. With WinRE now fixed it's possible again to make a recovery drive that can boot. Any 'above average' user who has Macrium is almost certainly going to get a Reflect patch and have to rebuild their recovery usb before 2023 is out, and with WinRE as the default base wim that too will 'just work'.

No, I don't think the average home PC user is going to be affected much by this. It's the likes of you and me that are worrying about it

hsehestedt · Aug 2, 2023

no1yak said:
I had a go at this revocation setting and all went well (or so I thought). Checked event viewer and found the 276 entry Windows boot manager revocation policy version 0x2000000000002 is applied, but no event 1035 in system. Anyone shed any light on this, cos I haven't a clue.
Win ver 22H2 2070 so it's up to date.

The 1035 entry is in a different log. It's in the system log in event viewer. Once you are in the system log you can select "Filter Current Log" from the actions pane on the right and then simply search for 1035.

Also, I'm fairly sure that if don't have Secure Boot enabled in your BIOS, you will not see the 1035. If Secure Boot is disabled, try enabling it. When you go back into Windows you should then have an event 1035 in the log.

hsehestedt · Aug 2, 2023

Bree said:
No, I don't think the average home PC user is going to be affected much by this. It's the likes of you and me that are worrying about it

Why do we insist on torturing ourselves with this stuff? Could it that that we actually enjoy this stuff?

Bree · Aug 2, 2023

hsehestedt said:
Why do we insist on torturing ourselves with this stuff? Could it that that we actually enjoy this stuff?

probably.

I've confirmed for myself that I can now make a Reflect rescue USB that will boot after the revocations are applied. That's all I was worried about, so I'll leave you to delve into the murky depths...

BrianInEngland · Aug 2, 2023

I don't use Secure boot and hopefully never get forced to by MS...

BrianInEngland · Aug 2, 2023

neves said:
While checking the official page and seeing that it shows Download Windows 11 (Current release: Windows 11 2022 Update l Version 22H2) - i thought it's still the old/unchanged MCT. Downloaded it just now and indeed - was changed/modified on 5 Mai 2023:

View attachment 64854

That's good to know (just in case).

The ISOs contain the May revocations stuff but as yet not the July '2nd stage' stuff (build 22621.1992).

Bree · Aug 2, 2023

BrianInEngland said:
The ISOs contain the May revocations stuff but as yet not the July '2nd stage' stuff (build 22621.1992).

That's the most important part, it means they can boot on a PC that has the revocations applied in order to do a clean install. The '2nd stage' stuff would get applied as soon as Windows checks for updates, so not so important to have them in the ISO.

Additional guidance for devices using Secure Boot to address CVE-2023-24932

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Well-known member

My Computers

( ͡° ͜ʖ ͡°)

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Similar threads