UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?

If you've applied Windows security patches but haven't manually revoked trust for older boot managers, your machine remains vulnerable to UEFI bootkits like BlackX.

A new UEFI bootkit named BlackX has infected fully patched Windows machines, bypassing Secure Boot protections. This follows the discovery of BlackLotus in 2023, the first publicly known UEFI bootkit to achieve this. Both BlackX and BlackLotus exploit a logic flaw called "Baton Drop" (CVE-2022-21894) in the Windows boot manager, which Microsoft patched in 2022. Despite Microsoft issuing further updates in 2023 and 2024 to revoke trust in vulnerable boot managers, these updates alone did not provide complete protection. The issue stems from Microsoft's cautious approach to revoking trust in older boot manager certificates to avoid rendering machines unbootable. This has created a prolonged state where the vulnerability remains exploitable if administrators do not take additional manual steps to revoke trust in the older signing certificate, a fact that Kaspersky researchers suggest was likely factored in by the creators of BlackX.

The BlackX incident highlights a critical gap in Microsoft's patch deployment strategy for UEFI vulnerabilities. While the company released technical fixes for the "Baton Drop" flaw, the effectiveness of these patches was contingent on administrators performing additional, manual steps to revoke trust in older signing certificates. This multi-stage approach, designed to prevent widespread unbootable systems, inadvertently created an extended window of opportunity for sophisticated malware like BlackLotus and now BlackX to exploit the "Baton Drop" vulnerability even on systems that had received the initial security updates.

This situation reveals the inherent tension between security and system stability in firmware-level protections. Microsoft's decision to delay full revocation of trust for older boot managers, while understandable from a user experience perspective, exposes a systemic risk. The success of BlackX, mirroring BlackLotus's exploitation of the same underlying flaw, suggests that security vendors must develop more robust methods for verifying boot integrity that do not rely solely on certificate revocation lists that can be gradually enforced.