Insyde's Security Pledge

Howyar Reloader UEFI Application vulnerable to execution of unsigned software in a hardcoded path.

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVE-2024-7344

The Howyar UEFI Application “Reloader” (32-bit and 64-bit), distributed as part of SysReturn prior to version 10.2.02320240919, is vulnerable to the execution of arbitrary software from a hard-coded path. An attacker who successfully exploits this vulnerability can bypass the UEFI Secure Boot feature and execute unsigned code during the boot process in the UEFI context.

Secure Boot DBX upgrade.

kernel 5.2, Version 05.2A.04
kernel 5.3, Version 05.39.04
kernel 5.4, Version 05.47.04
kernel 5.5, Version 05.55.04
kernel 5.6, Version 05.62.04
kernel 5.7, Version 05.71.04