To workaround this issue, do one of the following before you deploy this update: To view the PCR7 binding status, run the Microsoft System Information (Msinfo32.exe) tool with administrative permissions. If BitLocker Group Policy Configure TPM platform validation profile for native UEFI firmware configurations is enabled and PCR7 is selected by policy, it may result in the update failing to install. To learn more about this security vulnerability, see the following advisory:ĪDV200011 | Microsoft Guidance for Addressing Security Feature Bypass in GRUBįor additional information about this security vulnerability, see the following resources:ĬVE-2022-34301 | Eurosoft Boot Loader BypassĬVE-2022-34302 | New Horizon Data Systems Inc Boot Loader BypassĬVE-2022-34303 | Crypto Pro Boot Loader Bypass This security update addresses the vulnerability by adding the signatures of the known vulnerable UEFI modules to the DBX. An attacker who successfully exploited the vulnerability might bypass secure boot and load untrusted software. This update adds modules to the DBX.Ī security feature bypass vulnerability exists in secure boot. The Secure Boot Forbidden Signature Database (DBX) prevents UEFI modules from loading. Windows devices that has Unified Extensible Firmware Interface (UEFI) based firmware can run with Secure Boot enabled. This security update makes improvements to Secure Boot DBX for the supported Windows versions listed in the 'Applies to' section. Windows 10, version 1809 and Windows Server 2019Īzure Stack Data Box, version 1809 (ASDB)

Windows 10, version 1607 and Windows Server 2016 This security update applies only to the following Windows versions: Please see KB5016061: Addressing vulnerable and revoked Boot Managers for more information.

NOTE Improved diagnostics have been added to detect and report issue details through the event log.

0x800f0922 windows 10 20h2