Baton Drop

The Baton Drop vulnerability, designated CVE-2022-21894, is a flaw in the Windows boot loader that can be exploited to bypass Secure Boot - a security control that protects a Windows system during startup. This vulnerability was targeted by BlackLotus, a software threat that exploits two vulnerabilities in the UEFI Secure Boot function to gain control during the earliest phase of the software boot process. Despite Microsoft issuing a patch for this vulnerability in January 2022, the National Security Agency (NSA) warns that the threat is not fully remediated as boot loaders vulnerable to Baton Drop are still trusted by Secure Boot. BlackLotus has been utilized in attacks against Windows 10 and 11, exploiting the Baton Drop vulnerability to get around Secure Boot security and initiate a chain of malicious operations aimed at compromising system security. This is achieved by substituting fully patched boot loaders with vulnerable versions, thereby stripping the Secure Boot policy and preventing its enforcement. Even though the Baton Drop vulnerability was patched over a year ago, attackers with access to a compromised system can install a vulnerable bootloader and then exploit the vulnerability, gaining persistence and a more privileged level of control. Despite the patch issued by Microsoft, the certificate of the vulnerable version remains valid, making exploitation more difficult but not impossible. BlackLotus takes advantage of this, exploiting a second vulnerability, CVE-2023-24932, alongside Baton Drop to insert itself into the boot process. Administrators are warned not to consider the threat fully remediated, as bad actors can simply replace fully patched boot loaders with legitimate but vulnerable versions in order to execute BlackLotus on compromised endpoints.