TPM 2.0 Devices and remediation of CVE-2023-24932 (Black Lotus) UEFI / Secure Boot Vulnerability. - Help for those with "Known Issues"

Hello,
I have not been able to find assistance on this but if someone has found something please kindly link me a discussion that may already by started.

I won't beat this Black Lotus horse any more than it already has been... I find myself frustrated at the guidance in microsoft's official documentation on how to apply the mitigations ahead of the forced rollout:
How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932

Under the known issues section, I have a Dell Computer with a TPM 2.0.

I would like to get some guidance or a guide on how to rekey my machine and have the bad boot loaders revoked and not wait on a fix. is there any guidance on how to do so?

PS: I understand this is vague without any specifics. I will post them if this is the venue but for now I was more or less looking for a discussion on if this is possible, clarification on what the timing issues are with the TPM 2.0 systems and clarification on if this would be an appropriate venue for tackling this sort of task.

I have never been able to find this sort of guidance anywhere and as I am not a IT pro myself, or a complete security novice. I have a desire to tackle this sort of thing with a guide or how to.

Thanks! I look forward to any suggestions etc.

First let me say, I have secure boot disabled as I want no part of the revocation. I did find this flagged in my bookmarks but it is from 2023 but maybe it's what you want..

Welcome.

I’m a little lost because I am also not really an IT person. So you’re trying to install Windows or update without luck due to TPM2 issues and Secure Boot? Wanting to beat whatever is coming.

22H2 is really old.

If so, have you tried creating the install media and installing with Rufus?
Using as a fresh install media or for an in-place upgrade





As much as RUFUS can bypass TPM2.0 secure boot to upgrade to Windows 11 24H2, it will not work if the CPU lacks SSE4.2. Nothing will.

Again, I’m most likely out of my league and have mistaken your issue. Don’t try explaining, better I butt out.

P.S.

Here is a page that contains a security update posted in relation to CVE-2023-24932, created 6 days after July 9th (July 15th 2024)

NetMan304 said:

Under the known issues section, I have a Dell Computer with a TPM 2.0.

Code:

TPM 2.0-based systems:  These systems that run Windows Server 2012 and Windows Server 2012 R2
cannot deploy the mitigations released in the July 9, 2024 security update because of known compatibility issues with TPM measurements.
The July 9, 2024 security updates will block mitigations #2 (boot manager) and #3 (DBX update) on affected systems.

Microsoft is aware of the issue and an update will be released in the future to unblock TPM 2.0-based systems.

Click to expand...

Unless you're running Server 2012 on your PC's, this warning is irrelevant to you.

garlin said:

Unless you're running Server 2012 on your PC's, this warning is irrelevant to you.

Click to expand...

That’s what I was wondering when reading all that documentation. It referenced Server 2012 and Windows 8/8.1. That goes also for the download patches I linked to. Hence my confusion.

antspants said:

So you’re trying to install Windows or update without luck due to TPM2 issues and Secure Boot?
22H2 is really old.

Click to expand...

Let me clarify. I'm trying to do a clean install of Windows 10 that includes The mitigations for Black lotus all at once. Reload Bios / uefi from clean install using updated bootloader's and resetting Tpm with new keys, that aren't compromised.

I'm choosing Windows 10 due to personal preference. My computer is also compatible with Windows 11, per the manufacturer (Dell)

I can install Windows 10 just fine but since I have a TPM 2.0 the black lotus mitigation step #2 and #3 are automatically blocked on my system. This is in line with the documentation for Microsoft that states this will happen on those affected (tpm 2.0) systems + others.

I'm looking for a way to have a system with the mitigations applied for black lotus and not just a system that relies on revoked or vulnerable bootloaders.

Essentially I would like to apply the mitigations proactively and not wait for forced roll out.

garlin said:

Unless you're running Server 2012 on your PC's, this warning is irrelevant to you.

Click to expand...

I've always been under the impression that since these articles are geared towards IT professionals they only list "IT professional" builds as affected. It does appear that steps #2 and #3 are being blocked on my system.

Yes an update SHOULD be issued by Microsoft and / or OEM in due time but I am not wanting to wait..... If possible

NetMan304 said:

Yes an update SHOULD be issued by Microsoft and / or OEM in due time but I am not wanting to wait

Click to expand...

I can’t help but keep coming back to the fact Microsoft has dealt with this in 2023 & July 2024 . Also, again, Build 22H2 is extremely old and in itself, probably a security issue.


And again, again. I should probably stay out of it. Garlin always buries me with his knowledge.