CVE-2025-3052 Details

A vulnerability in Microsoft-signed UEFI firmware allows for arbitrary memory writes, enabling code execution of untrusted software and bypassing Secure Boot. This vulnerability affects several UEFI applications, including 'DTBios' and 'BiosFlashShell', all signed by the 'Microsoft Corporation UEFI CA 2011' key. The issue arises from improper handling of a runtime NVRAM variable, 'IhisiParamBuffer', which can be manipulated to overwrite critical firmware settings, such as those governing Secure Boot. Exploitation of this vulnerability could lead to the execution of malicious UEFI bootkits before the operating system is fully loaded, compromising system integrity and evading detection by conventional security measures.

To address this vulnerability, the affected UEFI applications must be updated to remove the vulnerable code. Additionally, the 'Dtbios-efi64-71.22.efi' module should be added to the UEFI Forbidden Signature Database (DBX) to prevent its execution under Secure Boot. This vulnerability has been found in multiple versions of the 'DTBios' application, so all variations should be added to the DBX database.