Kaspersky bootloader UEFI Secure Boot vulnerability

Microsoft has revoked Kaspersky vulnerable UEFI bootloader which could be used to circumvent Secure Boot. The update adds bootloader hash to dbx list, distributed via Windows Update. No dbx updates from UEFI Forum yet.https://t.co/IIKkf6UHN6 https://t.co/I3wtCAxZ2d

— ValdikSS (@ValdikSS) February 14, 2020

It took Microsoft more than 10 months to revoke the file. UEFI Forum stopped responding to my emails long ago.

This update introduced boot problems on some HP motherboards:https://t.co/IrmKS3xPHYhttps://t.co/mJXhzQ2da6

At least 2 other vuln bootloaders exist, not revoked.

— ValdikSS (@ValdikSS) February 14, 2020

good news they revoke one, bad news it’s not a single case of supply chain complexity problems

— Alex Matrosov (@matrosov) February 16, 2020